On 14 May 2021, Carousell Pte. Ltd. ("Carousell")
informed the Personal Data Protection Commission ("the
Commission")about an incident of unauthorized access to its
users' accounts due to a "credential stuffing"
attack. Credential stuffing refers to a type of cyberattack where a
cybercriminal accesses user accounts from one organisation using
the usernames and passwords stolen from another organisation.
Carousell was alerted to this issue due to reports by 2
users of Carousell. First, on 26 April 2021, a user reported that
their account was being hijacked and used to make unauthorised
purchases. Later on 1 June 2021, Carousell was alerted to another
incident alert involving the same modus operandi, which had
successfully made unauthorised purchases.
