Background

Algas Engineering Pte. Ltd. (the “Organisation”) notified the Personal Data Protection Commission (the “Commission”) on 15 April 2025 of a personal data breach involving its IT servers (the “Incident”).

The Organisation established that the threat actor (“TA”) had likely executed the ransomware attack on a project manager’s laptop, which was the only device encrypted during the Incident, during an upgrade of the Organisation’s Operating System. Owing to several system inadequacies, the TA exfiltrated the Organisation’s files containing the personal data of 500 individuals who were the Organisation’s current (70 individuals) and former employees (430 individuals).

The types of personal data affected included names, addresses, email addresses, telephone numbers, copies of national identification documents, passport numbers, photographs, dates of birth, bank account numbers and next-of-kin contact details.

Upon discovery of the Incident, the Organisation took prompt remedial actions including restricting access rights to project-related folders and enabling password protection where possible and optimising firewall configuration with intrusion prevention signatures. The Organisation also notified the affected individuals.

The data breach had likely occurred as the Organisation had inadequate security measures prior to the Incident such as lack in proactive monitoring that resulted in delayed detection, access to user endpoints and shared folders without additional password protection and inadequate training for employees on suspicious phishing emails. The Organisation’s servers were also vulnerable during the Operating System upgrade that may have created a window of exposure. The Organisation had basic protective measures in place including user access controls and password policies.

Voluntary Undertaking

Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “PDPA”). The Undertaking was executed on 26 March 2026.

As part of the Undertaking, the Organisation will implement the following including:

a. Enhancing existing vendor contract to include proactive monitoring of servers and networks;

b. Upgrading antivirus used for endpoints with Endpoint Detection & Response capabilities and monitoring;

c. Conducting quarterly vulnerability scans and applying patches timely; and

d. Conducting phishing awareness training and circulating periodic reminders.

The Commission will verify the Organisation’s compliance with the Undertaking. If the Organisation fails to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s compliance with the Undertaking.