Marina Bay Sands fined S$315,000 over data breach that affected more than 665,000 customers

“It is necessary to ensure that security policies are applied when properly migrating from the old software to the new, including data access rights,” said PDPC.

“In this case, one of the identifiers affecting the Art Science Friends webpage was omitted during the migration. This allowed malicious threat actor(s) to access and exfiltrate its patrons’ personal data.”

Such data leaks can be further exploited in phishing scams or identity theft, it added.

Despite the “clear risks” involved in such a migration exercise, PDPC noted that MBS relied on a single employee to manually compile a list of API configurations into the new software and did not implement second-layer checks.

As a result, MBS failed to discover and correct the omission for six months, leaving the personal data of its customers unprotected.

“MBS’ failure to put in place proper processes for something as critical as security policy was a negligent contravention of the Protection Obligation,” said PDPC.

“As a large enterprise with significant turnover in Singapore, it is clear that MBS had the required resources to protect their patrons’ personal data.”