On 21 September 2021, the Personal Data Protection Commission
("the Commission") fined Seriously Keto Pte. Ltd.
("Seriously Keto") a penalty of $8,000 over its of its
breach of its personal data protection obligations under the
Personal Data Protection ("PDPA"). In particular, the
Commission found that Seriously Keto had failed to implement
appropriate security measures in order to prevent unauthorised
access to personal data on its platform.
Context
On 16 June 2020, Seriously Keto notified the Personal Data
Protection Commission ("the Commission") of a ransomware
attack that had occurred on 15 June 2020. The attack affected the
personal data of over 3,000 individuals, and included,
inter
alia, names, addresses, email addresses, and phone numbers.
Seriously Keto requested the Commission to investigate the
incident. The organisation voluntarily provided facts for the
Commission and admitted that it had breached its personal data
protection obligations under
