The Personal Data Protection Commission ("PDPC")
recently meted out financial penalties to two errant entities which
were found to be in breach of Section 24 of the Personal Data
Protection Act 2012 ("PDPA").
- Royal Caribbean Cruises
(Asia) Pte. Ltd.
Royal Caribbean Cruises (Asia) Pte. Ltd. (the
"Organisation") voluntarily informed the PDPC that the
systems of one of its Information Technology ("IT")
vendors had been subject to a cyber-attack wherein the personal
data of about 6,000 of the Organisation's customers as well as
25 of its employees were deleted from the database and replaced
with a ransom message demanding payment in exchange for the deleted
data.
On discovering the incident, the Organisation took various
remedial actions, which included, but were not limited to, engaging
a cyber consultant to conduct technical forensic investigations and
identifying vulnerabilities in the hacked system and taking the
hacked system offline permanently.
