SIMBA Data Breach: What 23,549 Singapore Customers Should Watch For

Singapore telco SIMBA says personal data belonging to 23,549 of its customers was exposed in a breach on 24 September. The Personal Data Protection Commission (PDPC) has said it is aware of the incident and is investigating.

A month on, the risk for affected customers has shifted from the breach itself to what can be done with the data.

What was exposed

According to SIMBA's statement of 25 September, the exposed data included:

• names;
• identity card (IC) numbers;
• dates of birth;
• mobile numbers;
• email addresses.

SIMBA said no credit card or bank account information was at risk, and that there was no indication the data had been maliciously misused. The company said the incident was resolved, that it had reviewed the security measures protecting its core systems, and that it was working with the relevant authorities. It began notifying affected customers by email and said it expected to finish within a week.

SIMBA has not said publicly how the breach happened. The breach came shortly after an earnings call on 23 September at its Australian-listed parent company, Tuas Ltd.

Why this data is useful to scammers

None of these fields gives access to a bank account on its own. Together, though, they are the details that banks, telcos and government services use to confirm who someone is over the phone or online. Analysts covering the breach warned that IC numbers, birth dates and contact details can be combined into convincing phishing messages, used to impersonate customers, or used in social engineering against other service providers.

A message that quotes your full name, IC number and date of birth can look official precisely because it is accurate.

What affected customers can do

• Treat unexpected calls and messages with suspicion, especially ones that already know your personal details and use them to sound legitimate. Knowing your IC number does not prove a caller is from SIMBA, a bank or a government agency.
• Do not click links in SMS or email that ask you to verify your account, claim a refund or avoid a suspension. Go to the official app or website directly instead.
• Never share one-time passwords or Singpass approvals with anyone who calls or messages you.
• Watch for SIM swap attempts. If your phone suddenly loses service without explanation, contact your telco straight away, since a mobile number is often the second factor for bank logins.
• Use the official ScamShield app or the Anti-Scam Helpline to check suspicious messages and report scams.

The PDPC investigation will determine whether SIMBA met its obligations under the Personal Data Protection Act. The commission publishes its findings in data breach cases as decisions, and penalties can follow where an organisation is found not to have made reasonable security arrangements.