M1: Bank details not accessible during website breach

[SINGAPORE] M1 has clarified that its customers' credit card and bank account details were not accessible during its website security breach on Monday.

Only one case of unauthorised access has been detected, which revealed the personal information of 12 customers - including their names, addresses, and IC numbers.

BT understands the single case of unauthorised access stems from the customer who had alerted M1 to the security loophole.

M1 says it is in the process of contacting affected customers.

The kerfuffle began on Monday, when M1 had to suspend pre-orders for the new Apple iPhone 6 and 6 plus, after uncovering a "potential security breach" which compromised customers' personal information.

In a statement released on Wednesday night, M1 announced the preliminary findings of its investigation: "A security flaw existed in the design of an application programming interface in the customer authentication mechanism of our website. By changing data stored within a website "cookie", this allows possible access to another customer's personal information. A security patch was immediately developed and deployed which rectified the flaw."

In a separate incident on Tuesday, the personal data of over 300,000 customers of karaoke chain K Box Singapore was leaked online.

The Personal Data Protection Commission - a government body established last year to administer and enforce the Personal Data Protection Act 2012 - is investigating both the M1 and K Box matters.