Some MoneySmart customers in Singapore and Hong Kong have had their personal information copied after an unauthorised third party accessed the company’s internal IT systems.
The personal finance platform disclosed the incident on 3 November, saying it discovered the unauthorised access on 29 October. Its investigation subsequently confirmed that some customer data had been copied.
What Information Was Involved?
In customer emails seen by CNA, MoneySmart said the affected systems contained information users provided when comparing or applying for financial products, including names and email addresses.
Customers who submitted reward claims may also have had their shipping addresses and application or policy reference numbers copied.
The Straits Times also reported potential exposure of identification numbers, birth dates, income ranges and vehicle or insurance details.
MoneySmart is contacting affected customers directly to explain which information was involved and recommend protective steps, chief executive Vinod Nair said in a statement reported by 8world.
Access Blocked And Regulators Notified
MoneySmart said it stopped the unauthorised access after discovering the incident and took action to secure its systems. It also brought in independent cybersecurity and digital forensics specialists to investigate.
The company said it had notified regulators, including Singapore’s Personal Data Protection Commission and Monetary Authority of Singapore, as well as Hong Kong’s privacy commissioner’s office and Insurance Authority.
It has also tightened access controls and monitoring, and established a team to support affected customers, The Business Times reported.
Nair apologised to affected customers and said MoneySmart’s services continued operating normally. The company is reviewing the incident and making changes intended to prevent another breach.
Customers Advised To Watch For Suspicious Messages
MoneySmart advised customers to check their card statements and promptly report unfamiliar transactions to their banks.
It also warned them to be cautious about delivery or reward messages requesting personal details or payment, and to stay alert to unexpected calls, emails and messages.
Customers should not share passwords or one-time passwords, the company advised.
Those with questions can email [email protected].
