Courts hit with $178,000 fine over data breach affecting nearly 1m users

Courts has been fined $178,000 following a significant data security incident that exposed the personal information of approximately 1 million individuals, including customers and staff members. The breach represents one of the region's larger data compromise incidents in recent years.

Investigations determined that an attacker likely gained unauthorised access to Courts' network around September 21, 2022, through the company's backup servers designed to maintain business continuity during system failures. The breach went undetected for a considerable period before being discovered, allowing the attacker extended access to sensitive data.

The incident highlights vulnerabilities in disaster recovery infrastructure, which is often overlooked in cybersecurity planning despite being critical to business operations. Courts' backup systems, intended to protect the company from operational disruptions, instead became a potential entry point for malicious actors.

The regulatory penalty underscores growing enforcement action against companies failing to adequately protect personal data in Singapore. Authorities have intensified scrutiny of data security practices across retail and e-commerce sectors following multiple high-profile breaches in recent years.

Courts has not publicly detailed the specific nature of personal information compromised or remedial measures implemented since the discovery of the breach.