Background

PSGourmet Pte. Ltd. (the “Organisation”) notified the Personal Data Protection Commission (the “Commission”) on 26 June 2025 of a ransomware incident, involving the personal data of (current and former) employees and non-corporate customers (the “Incident”).

Investigations revealed that the threat actor had gained initial unauthorised access to the Organisation’s internal network using compromised login credentials for a dormant account via Virtual Private Network (“VPN”) which subsequently resulted in ransomware deployment and exfiltration of personal data. The personal data of an estimated 3,122 individuals were affected. There was no evidence that the exfiltrated personal data was published.

The types of personal data affected included names, addresses, email addresses, telephone numbers, dates of birth, NRIC numbers and financial information of bank account numbers and salary / CPF payments.

Upon discovery of the Incident, the Organisation took prompt remedial actions which included blocking inbound and outbound network traffic on the Organisation’s firewall, except for known good IP addresses and domains until confidence in the network’s security had been achieved, disabling VPN access and resetting all local VPN accounts to prevent further unauthorised entry during remediation efforts, and ensuring multi-factor authentication (“MFA”) was enforced for VPN users. The Organisation also notified the affected individuals.

The Incident had likely occurred as among other weaknesses: there was no MFA for the Organisation’s VPN, Endpoint Detection and Response (“EDR”) was not deployed on affected servers, a dormant account was not removed, and there was a lack of network segmentation.

Voluntary Undertaking

Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation to improve its compliance with the Personal Data Protection Act 2012 (the “PDPA”). The Undertaking was executed on 28 April 2026.

As part of the Undertaking, the Organisation has implemented or will be implementing measures including the following:

(a) Enforcing MFA for VPN access;

(b) Deploying EDR on all servers in Organisation’s network;

(c) Review and removal of unrequired accounts;

(d) Conducting data protection and security training for all staff;

(e) Conducting a security review of the Organisation’s network security posture and endpoints;

(f) Implementing records retention policies to purge personal data not required for statutory and business needs; and

(g) Initiating the process for Cyber Security Agency of Singapore’s Cyber Essentials Mark certification.

The Commission will verify the Organisation’s compliance with the Undertaking. If the Organisation fails to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s compliance with the Undertaking.