Cyberattacks reached five SPH Media systems and exposed data equivalent to 9% of its database, the Singapore publisher said, while payment-card details, financial or banking information and access to customer accounts were not compromised.
Email addresses made up most of the exposed information, with some names, mailing addresses and phone numbers also affected, SPH Media said. Reports did not state an absolute count of affected records or people.
SPH Media characterized the incidents as coordinated and said it believed a single threat actor was behind them. The company did not identify the actor.
Some of the affected systems held personal information and others did not, SPH Media said. The Straits Times reported that the company's news sites and subscription services were unaffected.
SPH Media said it reported the incidents to Singapore's Personal Data Protection Commission (PDPC), Cyber Security Agency of Singapore (CSA), Infocomm Media Development Authority (IMDA) and police, and brought in external cybersecurity specialists.
The Straits Times reported that software bugs and system configuration contributed to the breaches. The newspaper also reported that SPH Media applied software fixes, updated configurations and perimeter defenses, and increased monitoring.
The company urged customers to treat unexpected messages and calls with caution, especially when they request personal information, passwords or payments.
