Background

On 8 September 2025, Meisei International Private Limited (the “Organisation”) notified the Personal Data Protection Commission (the “Commission”) of a personal data breach involving a ransomware incident which affected multiple systems including its legacy Human Resource Management System (HRMS) server (the “Incident”).

The Organisation established that the threat actor (“TA”) likely gained initial access to its network using credentials from a compromised Virtual Private Network (VPN) account. Exploiting other system vulnerabilities, the TA encrypted the Organisation’s files on its HRMS server containing the personal data of 1,278 individuals who were the Organisation’s current (207 individuals) and former employees (1,071 individuals).

The types of personal data affected included a combination of names, copies of identification documents, dates of birth, marital status, mobile numbers, telephone numbers, email addresses, residential addresses, employment records and financial information comprising bank account numbers and salary records.

Upon discovery of the Incident, the Organisation took prompt remedial actions including isolating, reformatting and disconnecting the legacy HRMS server, and strengthening endpoint protection and monitoring across active servers and workstations. The Organisation also notified the affected individuals.

The Incident had likely occurred as the Organisation had inadequate security measures prior to the Incident including a weak password policy, absence of network segmentation which allowed the TA to move laterally across the Organisation’s system, absence of security measures for the decommissioned legacy server and no implementation of multi-factor authentication (“MFA”) for VPN accounts.

Voluntary Undertaking

Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “PDPA”). The Undertaking was executed on 30 March 2026.

As part of the Undertaking, the Organisation will implement the following including:

a. Enforcing MFA for all privileged accounts and implementing password complexity in accordance with guidelines from the Cyber Security Agency of Singapore;

b. Hardening network security to assess and harden security posture of network;

c. Conducting periodic vulnerability scans and annual penetration testing; and

d. Conducting mandatory PDPA and Cybersecurity awareness training for all employees, with annual refreshers.

The Commission will verify the Organisation’s compliance with the Undertaking. If the Organisation fails to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s compliance with the Undertaking.