The target: MyRepublic, a Singapore based Internet Service Provider
The take: 80,000 user records containing personally identifiable information such as: national identity cards with photos and addresses, names, copies of utility bills needed for verification, and mobile phone numbers.
The attack vector: The occurred due to unauthorized external access to from a 3rd party vendor employed by MyRepublic to store the firm’s documents needed for registration with their mobile service.
This breach highlights the risks of using third party vendors as the personal information exposed could lead to high targeted phishing attacks against the firm’s users. Up to date monitoring on where and what systems a firm’s data resides on, and regular audits on the effectiveness of the deployed protections, is essential for maintaining the expected industry standard of cybersecurity.