Singapore’s leading telecom company Singtel confirmed the exploitation of a third-party file-sharing system Accellion which led to a massive data breach that affected nearly 1,30,000 clients. Private information of clients including National Registration Identity Card numbers and a combination of names, dates of birth, contact numbers, and addresses have been stolen by the hackers.
Singtel, an associate of Bharti Airtel completed its initial investigation into the data leak and discovered which files on the Accellion file sharing system were illegally accessed. Hackers also managed to steal the bank account details of 28 former Singtel employees and credit card details of 45 staff members of a corporate client with Singtel mobile lines, the company stated in a news release.
Singtel said “some information from 23 enterprises, including suppliers, partners, and corporate customers, was also stolen. The company has started notifying all affected individuals and enterprises to help them and their staff manage the possible risks involved and take appropriate follow-up action.”
Yuen Kuan Moon, CEO of Singtel’s Group said in a news release that we are extremely apologetic for the inconvenience to our loyal customers due to this data breach and assured that we are taking all the necessary steps to beef up the security and negate the potential threats.
CEO said “data privacy is paramount; we have disappointed our stakeholders and not met the standards we have set for ourselves. Given the complexity and sensitivity of our investigations, we are being as transparent as possible and providing information that is accurate to the best of our knowledge. We are doing our level best to keep our customers supported in mitigating the potential risks.”
Telecom company explained that a large part of the stolen data comprises internal information that is non-sensitive such as data logs, test data, reports, and emails. Threat actors targeted Accellion file transfer appliance (FTA); a third-party file-sharing system used by Singtel to exploit the vulnerabilities.
When the company was initially alerted to exploits against the system in December last year, Singtel ‘promptly applied’ a series of patches provided by Accellion to patch the vulnerabilities. On January 23, Accellion advised that a new flaw has emerged that rendered the earlier patches previously applied in December incapable. Since January 23, the FTA system has been kept offline.
