← Whiz Communications

2023 Whiz Communications — 24,323 (~50% customers)

2023 24.3K records affected Share on X

Data compromised

ID documents, supporting documents

Technical writeup

CMS accepted Python script requests; attackers extracted ID documents (NRICs, passports, passes), tenancy agreements, work permits. 29,903 attempts from 8 overseas IPs. S$9,000 PDPC fine.

Root cause

Vendor CMS vulnerability; no Python script blocking

References