Background

Delugs Pte. Ltd. (the “Organisation”), a Singapore-based e-commerce business, notified the Personal Data Protection Commission (the “Commission”) on 15 December 2025 of a personal data breach involving its e-commerce storefront (the “Incident”).

The Organisation established that the threat actor (“TA”) had gained access to its e-commerce application on 4 December 2025 by using compromised credentials for an overseas-based employee’s administrator account, which was shared with another four customer service staff. Thereafter, the TA injected malicious JavaScript code, modifying the Organisation’s storefront theme. The malicious script redirected customers who placed orders through the Organisation’s online shopfront to a spoofed checkout page which allowed personal data entered by customers to be captured and transmitted to the TA’s infrastructure.

The Incident potentially affected 178 customers. The types of personal data affected included names, delivery addresses, email addresses, phone numbers and credit card information, specifically credit card numbers, expiry dates and CVV codes.

Upon discovery of the Incident, the Organisation took prompt remedial actions. This included removing the malicious script and reviewing all theme files for additional suspicious code, as well as deleting and re-creating all employee accounts on its e-commerce IT infrastructure. The Organisation also notified all the potentially affected customers.

The Incident likely occurred as the Organisation did not implement measures to prevent sharing of credentials for the compromised administrator account, which increased the likelihood of credentials being compromised despite the implementation of Multi-Factor Authentication. There was no enforcement of least privilege principles and the compromised account had excessive theme editing permissions, which the customer service staff did not require.

Voluntary Undertaking

Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012. The Undertaking was executed on 17 August 2026.

As part of the Undertaking, the Organisation has implemented or will be implementing measures including the following:

(a) Eliminating shared administrative accounts and prohibiting account credential sharing;

(b) Restricting administrative privileges based on role and operational necessity;

(c) Formalising internal personal data protection and IT security policies, encompassing access control and credential handling, employee responsibilities and confidentiality obligations; and incident response and escalation procedures;

(d) Conducting yearly audits and reviews of internal security policies and incident response plan;

(e) Conducting mandatory cybersecurity awareness training for all employees with annual refreshers; and

(f) Completing the Data Protection Essentials checklist, including formalising a data inventory and aligning existing policies with the framework's requirements.

The Commission will verify the Organisation’s compliance with the Undertaking. If the Organisation fails to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s compliance with the Undertaking.