MoneySmart Data Breach Hits Singapore and Hong Kong Users; PCPD Says 305,000 Hong Kong Records May Be Affected

MoneySmart, a site for comparing and applying for credit cards, loans and insurance in Singapore and Hong Kong, says an unauthorised third party got into some of its internal IT systems and copied customer data. The company found the intrusion on 29 October and told customers on 3 November, CNA reports. An independent investigation confirmed that some customer data was copied.

MoneySmart hasn't said how many people are affected, how the attacker got in or how long they were inside. Hong Kong's privacy regulator has given a figure: the incident may affect about 305,000 personal data records of Hong Kong people and 725 partial credit card numbers, the Office of the Privacy Commissioner for Personal Data (PCPD) told HK01.

What was taken

The affected systems hold personal data that customers share when they compare or apply for financial products, the company said. The emails to customers say the recipient's name and email address were taken. People who submitted reward claims may also have had their shipping address and application or policy reference number copied.

The Straits Times lists more fields as potentially accessed, including dates of birth, nationality, personal identification numbers, mobile numbers, income ranges and car insurance details. In Hong Kong, the PCPD's list covers name, date of birth, address, email, phone and financial information.

Regulators

MoneySmart notified Singapore's Personal Data Protection Commission and the Monetary Authority of Singapore, as well as Hong Kong's PCPD and Insurance Authority.

Both privacy regulators are investigating; the PDPC confirmed it to CNA.

MAS has asked the company for a "comprehensive root cause analysis", The Straits Times reports.

What MoneySmart tells customers

Its email asks customers to check their card statements and report any transaction they don't recognise to their bank, and to be wary of delivery or reward messages asking them to confirm details or pay a fee. MoneySmart says it will never ask for passwords, OTPs or banking details by phone or email. Customers with questions can write to [email protected].