pdpc_undertakings_version: 70

This data as json

_id _item _version _commit id organisation url timestamp description pdf-url pdf-content _item_full_hash
70 60 1 1011 35 Moncler Singapore Pte Ltd https://www.pdpc.gov.sg/undertakings/undertaking-by-moncler-singapore-pte-ltd 2024-03-21 Background  The Personal Data Protection Commission (the “Commission”) was notified by Moncler Singapore Pte. Limited (“Moncler”) on 24 February 2022 of a personal data breach involving the unauthorised access and exfiltration of personal data.   Investigations revealed that a malicious actor had utilised a sophisticated ransomware-as-a-service against Moncler’s corporate environments, possibly by using compromised credentials, vulnerability exploits, or spear-phishing. However, the exact cause of the breach could not be determined.   The malicious actor successfully deployed ransomware, encrypting and exfiltrating the personal data of 8,570 individuals (the “Incident”). The personal data affected included the name, date of birth, contact information, and purchase data of 8,561 customers, and the name, date of birth, contact information and payroll data of 9 employees. Remedial Actions After the Incident, as part of a remediation plan, Moncler put in place the following measures: (a)  Enhancing current cybersecurity training and awareness capabilities; (b)  Extending and refining Business Impact Analysis; (c)  Reviewing and improving its identity governance and access management solutions; (d)  Reviewing the security posture of the servers; (e)  Formalizing the application of its Vulnerability Management Process; (f)   Formalizing an IT Asset Management Program; (g)  Performing network security assessments; (h)  Improving Security Operation Center capabilities; and (i)   Implementing a configuration management database solution.   The Commission was satisfied with the remedial actions undertaken by Moncler. Undertaking  Having considered the circumstances of the case, the Commission accepted an undertaking from Moncler to improve its compliance with the Personal Data Protection Act 2012. The undertaking was executed on 29 June 2022 (the “Undertaking”).   The Commission accepted the Undertaking having considered the number of affected individuals, the types of personal data involved and the impact of the Incident. Accepting the Undertaking was also consistent with the Commission’s practice with respect to other personal data breaches similar to the one that affected Moncler.    Moncler has since updated the Commission that it has completed the implementation of its remediation plan. The Commission has reviewed the matter and is satisfied that Moncler has complied with the terms of the Undertaking. Please click here to view the Undertaking. https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/undertakings/undertaking---moncler-singapore-pte-ltd.pdf WRITTEN VOLUNTARY UNDERTAKING (“Undertaking”) TO THE PERSONAL DATA PROTECTION COMMISSION This Undertaking is given to the Personal Data Protection Commission or its delegates pursuant to section 48L(1) of the PDPA, by: Moncler Singapore Pte. Limited UEN: 201531580G Registered Address: 135 Cecil Street, #10-01, Philippine Airlines Building, Singapore 069536 (hereinafter referred to as the “Organisation”). By signing this Undertaking, the above-named Organisation acknowledges the matters stated herein and undertakes to the Commission in the terms set out herein. 1. DEFINITIONS In this Undertaking: (a) “PDPA” means the Personal Data Protection Act 2012; and (b) “Relevant Provisions” means the provisions in Parts III, IV, V, VI, VIA and IX, and section 48B(1) of the PDPA. 2. ACKNOWLEDGEMENTS 2.1 The Organisation hereby acknowledges the following matters: (a) The Commission has carried out investigations into certain acts and practices of the Organisation, and has reason to believe that the Organisation has not complied, is not complying, or is likely not to comply with one or more of the Relevant Provisions. The relevant facts and circumstances are summarised at Schedule A. (b) As a result of any non-compliance with the PDPA by an organisation, the Commission has a number of enforcement options under the PDPA, including the option to issue directions under sections 48I or 48J of the PDPA. (c) The Commission recognises that the Organisation has made efforts to address the concerns raised in this case and to improve its personal data Page 1 of 8 protection practices. In addition, the Organisation was cooperative in the course of the investigation and was responsive to requests for information. The Commission further recognises that the Organisation appears ready to implement or is in the midst of implementing the steps set out in Schedule B. (d) Having carefully considered all the relevant facts and circumstances, the Commission takes the view that this is an appropriate case in which an Undertaking may be accepted. 2.2 The Organisation also acknowledges and agrees that the Commission may publish and make publicly available this Undertaking, and without limitation to the foregoing, the Commission may issue public statements referring to this Undertaking and/or its contents in whole or in part. 3. UNDERTAKINGS The Organisation undertakes that it has taken, or will take all necessary steps, to carry out the actions or refrain from carrying out the actions referred to in Schedule B, and where applicable, in accordance with the stipulated timelines. 4. COMMENCEMENT This Undertaking shall take effect upon the acceptance by the Commission of the Organisation’s duly executed Undertaking. 5. THE COMMISSION’S STATUTORY POWERS 5.1 In order to provide the Organisation with an opportunity to complete all necessary steps to implement its undertakings set out in clause 3 above, the Commission will exercise its powers under section 50(3)(ca) of the PDPA to suspend the investigations referred to in clause 2 on the date the Undertaking takes effect as set out in clause 4.1. 5.2 The Organisation acknowledges that the Commission will verify the Organisation’s compliance with its undertakings set out in clause 3 above, and if necessary, will exercise its powers under the Ninth Schedule of the PDPA to do so. 5.3 Clause 5.1 above shall be without prejudice to the Commission’s statutory powers to conduct or resume, at any time, the investigations referred to in clause 2 above if it thinks fit, including but not limited to the situation where the Page 2 of 8 Organisation fails to comply with this Undertaking or part thereof in relation to any matter. 5.4 Nothing in this Undertaking, including the Commission’s acceptance of the Undertaking, is intended to, or shall, fetter or constrain the Commission’s rights and statutory powers (including but not limited to those under sections 48I, 48J, 48L(4) and 50 of the PDPA) in any manner. Neither shall be construed as creating any anticipation or expectation that the Commission will take or not take any particular course of action in the future (whether in the present case or in respect of any other case concerning a breach or suspected breach of the PDPA). The acceptance of this Undertaking is strictly confined to the particular facts of the present case, and is made on the basis of the representations and information provided by the Organisation. The acceptance of an Undertaking in this case shall not be construed as establishing any precedent. 6. VARIATION This Undertaking may be varied only with the express written agreement of the Commission. This document has been electronically signed. The Parties hereby affirm that the electronic signatures have been affixed with the due authorisation of each Party and that Parties intend for the electronic signatures to carry the same weight, effect and meaning as hand-signed wet-ink signatures. SIGNED, for and on behalf of ) Moncler Singapore Pte. Limited ) By the following: ) Name: ______________________________________ ) Designation: _________________________________ ) Date: _______________________________________ ) Page 3 of 8 ACCEPTED by ) ) Name: ______________________________________ ) Designation: Deputy Commissioner Personal Data Protection ) Date: _______________________________________ ) Page 4 of 8 SCHEDULE A Page 5 of 8 SUMMARY OF FACTS 1. On 24 February 2022, the PDPC was informed that the Organisation was subjected to a ransomware attack, resulting in encryption and exfiltration of its database. 2. As a result, the personal data of 8,561 customers including their names, date of birth, email addresses, telephone numbers, and purchase data was exfiltrated. In addition, the personal data of another 9 employees, including their name, date of birth, contact information, and payroll data which includes health data, bank account information and other categories of data connected to the employment relationship, was also exfiltrated. 3. To prevent a recurrence of a similar incident, the Organisation took immediate remedial action to address the possible causes of the personal data breach. Page 6 of 8 SCHEDULE B Page 7 of 8 REMEDIATION PLAN S/N Item Target Completion 1 Enhancing current Cybersecurity Training & Awareness capabilities Q4 2022 2 Extending and refining Business Impact Analysis Q3 2022 3 Reviewing and Improving Identity Governance and Access Management solutions Q4 2022 4 Reviewing the security posture of the Group’s servers Q1 2023 5 Formalizing the application of Vulnerability Management Process Q3 2023 6 Formalizing an IT Asset Management Program Q1 2023 7 Performing Network Security assessments Q2 2023 8 Improving Security Operation Center capabilities Q1 2023 9 Implement Configuration Management Database Solution Q4 2023 Page 8 of 8 f5f37a9788543a7c41ed6711fe11f98272f30c2c

Links from other tables