Background

On 30 October 2025, Bud Studio Pte. Ltd. (the “Organisation”) notified the Personal Data Protection Commission (the “Commission”) of a personal data breach involving its Network Attached Storage (“NAS”) server (the “Incident”). The Organisation is a Singapore-based design and build practice.

The Organisation established that it had suffered a ransomware attack on its NAS server on 27 October 2025, resulting in unauthorised access and modification by the threat actor(s) to the NAS server, affecting files holding personal data of approximately 252 individuals. There was no evidence of exfiltration or publication.

The types of personal data affected included a combination of their names, NRIC numbers, telephone numbers, addresses, personal email addresses, as well as the signatures and NRIC copies of 2 individuals.

The Organisation was lacklustre in its cybersecurity and data protection practices and was unaware of the security and maintenance of its IT infrastructure as it was primarily reliant on its IT vendor for the aforementioned. The Incident had likely occurred because of the absence of security measures, such as multi-factor authentication. At the time of the Incident, the Organisation had not developed or implemented any data protection policies or measures as required under sections 11 and 12 of the PDPA, including not having designated a data protection officer and not having documented internal and external data protection policies.

Remedial Actions

After the incident, the Organisation implemented the following remedial measures:

(a) Appointed a DPO; and

(b) Formulated an interim personal data protection policy.

Voluntary Undertaking

Having considered the circumstances of the case and the lack of knowledge by the Organisation in cybersecurity and data protection practices, the Commission accepted a voluntary undertaking (the “Undertaking”), which was executed on 24 June 2026, from the Organisation to engage an external service provider to improve its cybersecurity set-up and its data protection practices and policies.

As part of the Undertaking, the external service provider will assist the Organisation to first complete an initial set-up within 2 months. The initial set-up will include the registration of the DPO with the Commission or the Accounting and Corporate Regulatory Authority (“ACRA”), establishing an asset inventory for personal/business data, an IT asset inventory for hardware and software, developing an incident response and data breach management plan and implementing the necessary cybersecurity measures to protect personal data. A review will then be conducted 6 months after the initial set-up to ensure, amongst others, that the latest software updates have been installed on the Organisation’s devices and systems.

The Commission will verify the Organisation’s compliance with the Undertaking. If the Organisation fails to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s compliance with the Undertaking.