SPH Media Data Breach: Attacks on Five Systems Expose About 9% of the Customer Database

SPH Media, the Singapore publisher of The Straits Times, says attackers broke into five of its systems between 4 and 8 November and exposed about nine per cent of its customer database. The data is "predominantly e-mail addresses, as well as some names, mailing addresses and phone numbers". Some employees' email addresses were taken too. The company declined to say how many people are affected.

The Straits Times, reporting the company's 10 November statement, says no payment card details, financial or banking information, or customer account was compromised. Mothership adds passwords to that list, and says no corporate customers' data was touched.

Bugs, configuration and possibly AI

SPH Media puts the breaches down to "a combination of factors, including software bugs and system configuration". The Business Times, another SPH title, reports that intruders got in through "two portals used by staff and vendors supporting subscriber orders", and that the company ruled out phishing, users clicking links or a third-party system.

Preliminary findings point to one attacker. The company calls the incidents "a concerted effort that was carried out by the same threat actor" and suspects they "could be AI-enabled attacks".

It hasn't said what that suspicion rests on.

Regulators and fixes

The incidents were reported to the Personal Data Protection Commission, the Cyber Security Agency of Singapore and the Infocomm Media Development Authority, and a police report has been filed. SPH Media says it has applied bug fixes, changed system configurations, tightened perimeter defences and brought in outside security experts.

What customers are told to do

The email to affected subscribers warns that the exposed details "could potentially be used for phishing or scam attempts". SPH Media asks customers to treat unsolicited emails, messages and calls with caution, especially ones asking for personal details, passwords or payment, and not to click unknown links or open unexpected attachments. Mothership says the email also tells readers to check delivery notices through official channels and turn on two-step login. Questions go to SPH Media customer service on 6388 3838.