Background

D’League Pte. Ltd. (the “Organisation”) notified the Personal Data Protection Commission (the “Commission”) on 8 August 2025 of a personal data breach involving its systems (the “Incident”).

The Organisation established that on or about 15 July 2025, a threat actor (“TA”) had accessed its systems and exfiltrated its data, before encrypting its systems. These systems contained personal data of the Organisation and its subsidiaries, namely Richard Mille Asia Pte. Ltd, Henry Jacques Asia Pte. Ltd, The Value of Time (Asia) Pte. Ltd, Surrender Pte. Ltd.¹, Three Pleasures Pte. Ltd, Inca Holdings Pte. Ltd, Le Mondo Ryori Pte. Ltd and Shinsetsu Pte. Ltd (collectively, the “Subsidiaries”).

The Organisation determined that the TA had likely obtained access to its systems through credentials associated with a compromised, dormant Virtual Private Network (“VPN”) account used by, or belonging to, a staff member or representative of the Organisation’s external IT consultant.

The Incident affected the personal data of 17,626 individuals, comprising employees, former employees, non-employees and customers of the Organisation and its Subsidiaries. The types of personal data affected included a combination of names, NRIC numbers, passport copies, nationalities, dates of birth, addresses, emails, contact numbers, genders, transaction history, financial information (including names, bank account numbers, and names of bank), employees’ hospitalisation documents and medical certificates.

Upon discovery of the Incident, the Organisation took prompt remedial actions including removing all VPN user accounts, creating only essential VPN accounts, enforcing multi-factor authentication (“MFA”) for all VPN users and restricting VPN connections. The Organisation also notified the affected individuals.

The Incident had likely occurred as the Organisation had inadequate security measures prior to the Incident including not removing a dormant VPN account, the absence of MFA for VPN and privileged accounts, and insufficient endpoint protection.

Voluntary Undertaking

Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation and its Subsidiaries to improve their compliance with the Personal Data Protection Act 2012 (the “PDPA”). The Undertaking was executed on 12 May 2026.

As part of the Undertaking, the Organisation and its Subsidiaries will implement the following including:

(a) Conducting regular reviews of VPN accounts and deactivating or removing dormant user accounts;

(b) Enabling and enforcing MFA for all VPN users;

(c) Implementing geofencing on the firewall to include only countries which the Organisation and its Subsidaries operate in;

(d) Implementing and deploying managed detection and response;

(e) Developing and implementing a cybersecurity incident response plan; and

(f) Conducting a Vulnerability Assessment and Penetration Testing exercise, and email phishing simulation exercise for the Organisation, its Subsidiaries and all employees.

The Commission will verify the Organisation’s and its Subsidiaries’ compliance with the Undertaking. If the Organisation and its Subsidiaries fail to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s and its Subsidiaries’ compliance with the Undertaking.

^[1] Surrender Pte. Ltd. has been struck off from ACRA since 8 May 2023.