Section
Cyber news for Southeast Asia and India, published daily: breaches and ransomware claims, scam-centre prosecutions, regulators and courts, plus the worldwide flaws that need patching now.
M1 data breach: the Singapore telco says customer names, NRIC/FIN numbers, birth dates, phone numbers and addresses were exposed on 30 October. Payment data was not, it says.
Vietnam's State Bank monitoring system has flagged more than 668,000 bank, e-wallet and payment accounts showing signs of law violations, a senior officer of the police cyber unit A05 said.
Pattaya mule account raid: Thai police arrested eight people in a condominium on 5 November and link the ring to online fraud losses of more than 100 million baht nationwide.
CSA tells Singapore firms to take operational technology control systems off the public internet after attacks on supermarket fridges in Europe. It has no reports of similar incidents here.
Data breach at Doctor Anywhere: the Singapore telehealth and clinic operator says an unknown third party accessed users' personal data. It says clinical records were not affected.
Philippine government data breach claims now name the DOTr, SEC, BIR and Coast Guard. The National Privacy Commission says no agency has notified it of a breach.
Thailand Post postmen will photograph and GPS-tag the addresses given in company registrations, so Thailand's business registry can catch shell firms opened to run mule accounts for scammers.
RBI's cyber resilience Master Directions of 5 November fold system-audit rules and controls for third-party ATM switch providers into one rulebook for non-bank payment system operators.
A fake BNM Mobile Security app is relaying Malaysians' bank cards over NFC to scammers for ATM withdrawals and contactless payments, MyCERT warned on 4 November.
Apple CVE-2024-27834, a WebKit flaw patched in May 2024, is now on CISA's exploited list. Sekoia found it in a chain stealing cookies from iPhones on iOS 16.0 to 17.4.
An OpenSSH password authentication bypass lets attackers into Alpine Linux servers running sshd without PAM through accounts with no password set. Fixed packages shipped on 5 November; no CVE has been assigned.
Zyxel GS1900 switches patched in June are still open to unauthenticated command execution. The new flaw, CVE-2026-107441, is fixed in 2.90 Patch 3 firmware.
