Background

Prosegur Singapore Pte. Ltd. (the “Organisation”) informed the Personal Data Protection Commission (the “Commission”) on 27 August 2025 of a personal data breach involving its file servers (the “Incident”).

The Organisation established that the threat actor (“TA”) had gained initial unauthorised access to the Organisation’s file servers on 23 June 2025, using compromised login credentials of a service account via Virtual Private Network, which subsequently resulted in the exfiltration of a subset of the affected personal data of the Organisation’s employees, former employees and contractors. The personal data of 21,421 individuals were affected, with a smaller number exfiltrated.

The types of personal data affected included a combination of names, addresses, telephone/mobile numbers, NRIC/FIN/passport numbers, countries of origin, photographs, dates of birth, salary histories and a smaller subset of health – mainly vaccination information, belonging to approximately 2,514 individuals.

Upon discovery of the Incident, the Organisation took prompt remedial actions including isolating the compromised server, restricting access rights to databases to reduce exposure and renewing all Active Directory user credentials to strengthen identity control and access management. The Organisation also notified the affected individuals.

The data breach had likely occurred as the Organisation did not implement multi factor authentication (“MFA”) for remote access to the compromised service account and did not fully apply network segmentation to protect personal data in its possession. The Organisation had other protective measures in place including network security with two pairs of firewall, patch management and endpoint solutions.

Voluntary Undertaking

Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “PDPA”). The Undertaking was executed on 28 July 2026.

As part of the Undertaking, the Organisation has implemented or will be implementing measures including the following:

(a) Creating a new identity management system for all employees, with the goal of implementing a robust credential policy that includes MFA, password length, account history control, expiration and change policies;

(b) Implementing a segmented network architecture;

(c) Obtaining the Cyber Essentials Mark Certification; and

(d) Hardening of service account authentication, including certificate/key-based authentication or strong password rotation with restrictions.

The Commission will verify the Organisation’s compliance with the Undertaking. If the Organisation fails to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s compliance with the Undertaking.