SPH Media reports cyberattacks that exposed email addresses but not financial data

SPH Media said on Nov 10 that cyberattacks affected roughly 9% of its database, exposing primarily email addresses along with some names, mailing addresses and phone numbers. The company said no payment card details, financial or banking information, or customer accounts were compromised.

In a statement, the media group said it identified attacks on five systems and believes they were carried out by the same threat actor. The first incident was detected on Nov 4 and the latest on Nov 8. Preliminary investigations suggest the intrusions could be AI-enabled, stemming from software bugs and system-configuration issues.

The company said it immediately secured the affected systems and engaged external cybersecurity experts to investigate and contain the breaches. It also reported the incidents to the Personal Data Protection Commission, the Cyber Security Agency of Singapore, the Infocomm Media Development Authority and filed a police report.

"SPH Media takes the security and confidentiality of customers’ information very seriously, and has been working very closely with the relevant authorities and third-party specialists," the spokesman said.

"We advise customers to remain vigilant and exercise caution for suspicious and unsolicited e-mails, messages and calls, particularly those requesting personal information, passwords or payments, and to avoid clicking on suspicious links or attachments," he added.

The attacks targeted two groups of systems managed in-house: one containing personal data and another that did not store personal data. The group’s news sites and subscription services were not affected. SPH Media applied bug fixes, updated system configurations and strengthened perimeter defenses to block further probing. It also heightened monitoring and is enhancing safeguards to detect AI-aided attacks.

"We remain committed to safeguarding our systems and the information entrusted to us," the spokesman said.