MoneySmart hit by data breach; Singapore, Hong Kong customers affected

[SINGAPORE] Finance platform MoneySmart has been hit by a data breach, in which an unauthorised third party gained access to its internal IT systems and copied personal information belonging to customers in Singapore and Hong Kong.

In an e-mail to affected customers on Tuesday (Nov 3), MoneySmart said that it discovered the unauthorised access on Thursday. The affected systems contained personal data provided by customers when comparing or applying for financial products through its platform.

An independent investigation confirmed that some customer data was copied from its systems.

The e-mail, seen by The Business Times, indicated that the compromised data included the recipient’s name and e-mail address.

It is not immediately clear how many customers were affected or whether other types of personal data were compromised in the incident.

MoneySmart also did not disclose how the unauthorised party had gained access to its systems or for how long the breach had gone undetected.

THE BUSINESS TIMES INSIGHTS

Powering Asean's Future 2026

Find out how enterprises are navigating power constraints and sustainability targets

ACCESS THE INSIGHTS

The company said that it immediately cut off the unauthorised access after discovering the breach and engaged independent cybersecurity and forensic experts to investigate.

It has notified regulators, including Singapore’s Personal Data Protection Commission and the Monetary Authority of Singapore (MAS), as well as Hong Kong’s Office of the Privacy Commissioner for Personal Data and Insurance Authority.

In a response to queries from BT, MAS said that it was following up closely with MoneySmart Financial – the group’s MAS-regulated insurance broker, over the incident.

SEE ALSO

How to break Singapore’s IPO curse

Private equity’s liquidity crunch fuels growth in secondaries, alternative fund structures

The regulator has directed the broker to ensure that the breach has been contained and its IT environment secured.

It has also asked the company to conduct a comprehensive root cause analysis and implement appropriate remedial measures.

MoneySmart added that it has strengthened access controls and systems monitoring, and set up a dedicated team to support affected customers.

“We are responsible for protecting your information, and resolving this is our highest priority,” said MoneySmart CEO Vinod Nair in a separate statement on Tuesday.

MoneySmart advised customers to remain vigilant against suspicious calls, e-mails and messages, and to avoid sharing passwords or one-time passwords.