In brief

On 3 July 2025, the Personal Data Protection Commission (PDPC) ordered Ezynetic Pte. Ltd. (“Organisation”) to pay a financial penalty of SGD 17,500 for breaching its protection obligation under the Personal Data Protection Act 2012. The breach resulted in the exfiltration of personal data belonging to 190,589 individuals, which were posted for sale on the dark web. The PDPC also directed the Organisation to obtain the Cyber Security Agency’s Cyber Trustmark Certification for its new IT network within nine months of the PDPC’s decision.      

Key facts

The Organisation is a Software-as-a-Service (SaaS) provider that provides information technology solutions and services to licensed moneylenders in Singapore. As part of its services, the Organisation’s clients would input personal data of their prospective loan applicants and borrowers into a system which allows them to verify the applicants’ and borrowers’ loan eligibility, generate Moneylenders Credit Bureau reports, track the loans, instalments, collections, payments and generation of profit and loss reports. 

On or about 24 June 2024, the Organisation’s servers were infected by ransomware and it discovered it could not access its system. Investigations revealed that a threat actor had exploited a vulnerable web service to gain access to the system administrator account as the Organisation: 

1. Failed to disable or adequately secure the system administrator account, which is a well-known target of malicious users. The system administrator account, which had privileged access, was protected by weak passwords such as “p@ssword1” or “Password@1”, making it highly susceptible to brute force attacks; and
2. Had not conducted any periodic vulnerability assessments or penetration testing of its infrastructure.

Findings and basis for determination

The PDPC found that the Organisation contravened its Protection Obligation under section 24(a) of the PDPA as it failed to: 

1. Have reasonable access controls such as implementing and enforcing a strong password policy that includes a minimum level of password complexity and a fixed period of password validity or regular change of passwords. This was necessary considering the volume and types of personal data in the possession and under the control of the Organisation; and
2. Conduct reasonable periodic security reviews, such as conducting web application vulnerability scanning and assessments post deployment, or penetration testing.

Key takeaways

This case is a timely reminder for  organisations that poor cyber hygiene measures such as weak password policies and infrequent security audits seriously expose organisations to cyberattacks and data breaches, and also enforcement action by the PDPC for a breach of the PDPA . In particular, the PDPC’s comment that the Organisation as a SaaS provider should possess the necessary technical expertise to implement reasonable cybersecurity measures to address evolving threats highlights the higher expectations on businesses in the technology sector to take appropriate and reasonable security arrangements to protect personal data in their possession or control . 

The PDPC also indicated that incurring significant financial expenses in implementing remedial measures post-data breach is not necessarily a mitigating factor for any financial penalty imposed as such measures are a necessary part of an organisation’s ordinary compliance with the PDPA’s Protection Obligation. Accordingly, organisations should ensure they invest and implement in both prevention and remediation in their cybersecurity and data protection compliance strategy.