Background

On 29 April 2025, Kingsmen Creatives Ltd. (the “Organisation”) notified the Personal Data Protection Commission (the “Commission”) of a personal data breach involving a ransomware attack which affected multiple servers and a user’s laptop (the “Incident”).

The Organisation established that the threat actor (“TA”) likely gained access to its system on 26 April 2025 using credentials from a compromised Virtual Private Network (“VPN”) account. Exploiting other system vulnerabilities, the TA encrypted the Organisation’s files containing the personal data of 445 individuals, who were the Organisation’s current (342 individuals) and former (103 individuals) employees.

The types of personal data affected included names, NRIC numbers, NRIC copies, dates of birth, contact information (mobile numbers, email addresses and home addresses), bank account details (bank name and bank account number) and next-of-kin details (names, mobile numbers and relationship to the employee).

Upon discovery of the Incident, the Organisation took prompt remedial actions including isolating affected network systems, blocking all incoming traffic from the firewall while allowing only outbound connectivity on weekdays, resetting all account passwords and retaining only a single administrative account on the Domain Controller. The Organisation also notified the affected individuals.

The Incident had likely occurred as the Organisation had inadequate security measures prior to the Incident including a weak password policy, absence of regular access reviews, absence of a documented incident response plan and no implementation of multi-factor authentication (“MFA”) for VPN and privileged accounts.

Voluntary Undertaking

Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “PDPA”). The Undertaking was executed on 24 March 2026.

As part of the Undertaking, the Organisation will implement the following, including:

a. Enforcing mandatory MFA for all user accounts across Office 365, email, and administrative systems, and revising its password policy;

b. Introducing new processes such as Change Management, Patch Management, Incident Response and Dual Control Keys for break-glass accounts;

c. Establishing incident response and business continuity plans;

d. Conducting cybersecurity awareness training for all employees, both new and existing; and

e. Reviewing and enhancing its personal data protection policy.

The Commission will verify the Organisation’s compliance with the Undertaking. If the Organisation fails to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s compliance with the Undertaking.