Background

Ascentis Pte. Ltd. (the “Organisation”) notified the Personal Data Protection Commission (the “Commission”) on 10 August 2025 of a personal data breach involving databases of a customer relationship management (“CRM”) platform developed by the Organisation (the “Incident”).

The Organisation established that the threat actor (“TA”) had accessed its servers and encrypted its data. The compromised servers, located in the Organisation’s on-premises data centre, included those storing the databases of three other organisations that had contracted CRM services from the Organisation.

The data breach affected 9,886 individuals who were the customers of the three organisations mentioned above. The types of personal data affected included their name, email address, mobile number and date of birth. There was no evidence of public exposure or misuse of the affected personal data.

Upon discovery of the Incident, the Organisation took prompt remedial actions including enhancing the security of various user accounts, firewall policy, Active Directory domain policy, amongst other measures. The Organisation also notified the 3 affected organisations.

The Organisation had inadequate security measures prior to the Incident, including failure to implement multi-factor authentication for two user accounts accessing the firewall console, inadequate firewall hardening and access control with outdated and unused rules not being removed, and inadequate password policy for certain types of user accounts.

Voluntary Undertaking

Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “PDPA”). The Undertaking was executed on 15 April 2026.

As part of the Undertaking, the Organisation will be implementing the following including:

(a) Enforcing multi-factor authentication for access to firewall; and

(b) Enhanced logging and monitoring.

The Commission will verify the Organisation’s compliance with the Undertaking. If the Organisation fails to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s compliance with the Undertaking.