MoneySmart data breach hits S’pore, HK users; IC numbers, financial info potentially exposed - The Straits Times

MoneySmart operates an online platform that allows consumers to evaluate, compare and purchase products.

SINGAPORE – The personal data of some MoneySmart customers in Singapore and Hong Kong has been compromised after hackers breached the personal finance portal’s internal IT systems in October.

In an e-mail sent to affected users on Nov 2 and 3 and seen by The Straits Times, the platform said an unauthorised third party gained access to some of its internal information technology systems on Oct 29.

“These systems hold personal data that customers share with us when they compare or apply for financial products through MoneySmart,” it said.

MoneySmart’s online platform allows consumers to evaluate, compare and apply for financial products, including credit cards, personal loans and travel insurance.

In response to queries from ST on Nov 3, the company confirmed that personal data belonging to some customers in Singapore and Hong Kong was copied.

MoneySmart is contacting customers impacted by the breach directly to explain what data was involved and recommend steps they can take to protect themselves. It did not say how many users were impacted in its response to queries from ST.

“As soon as we discovered the incident, we stopped the unauthorised access and took steps to secure our systems,” MoneySmart chief executive Vinod Nair said.

Regulators in both markets have been alerted, including the Personal Data Protection Commission (PDPC) and the Monetary Authority of Singapore (MAS), alongside the Office of the Privacy Commissioner for Personal Data and the Insurance Authority in Hong Kong.

Independent cybersecurity and digital forensics experts have been hired to investigate the breach, the company added.

Meanwhile, MoneySmart emphasised that its operations continue as normal.

“MoneySmart continues to operate as normal, and we are committed to supporting our customers,” said MoneySmart CEO Nair.

“We are reviewing everything that led to this incident and making the changes needed to prevent it from happening again,” he added.

“I am deeply sorry to everyone affected,” said Nair. “Customers trust us with information about their financial lives, and we take that responsibility very seriously.”

ST has contacted MoneySmart, PDPC, MAS, the Cyber Security Agency of Singapore and the police for more information.