If a scammer rings you up and calls you by your name, NRIC number and address, don’t be surprised. Assume the crooks know you so well now because your information has been leaked from one of many recent data breaches.
Just yesterday, news of two alarming leaks came from organisations that you’d place a lot of trust in – telecom operator M1 and remote medical service Doctor Anywhere.
M1 said a data breach on October 30 exposed the names, NRIC or FIN numbers, dates of birth, mobile numbers, e-mail addresses and residential addresses.
Doctor Anywhere, meanwhile, said a “malicious cyber incident” involving “unauthorised access by an unknown third party” had leaked personal data of its users.
It didn’t detail what information was exposed but said that clinical records were not affected.
On its part, M1 said no financial or banking information was compromised, nor were the hackers able to access customer accounts.
That the hackers hadn’t managed to steal more privileged information or access is small relief for customers of these companies. They are now easier victims for scammers looking to target them in future.
The stolen personal data is usually collated and sold on illegal underground sites on the Web in bulk to hackers who want to target, say, Singapore residents.
Let’s not just focus on only the latest incidents. The Singapore Land Authority (SLA) also reported the personal data of 70,000 people were leaked just four months ago.
With all this information, scammers can more easily put two and two together and form a much clearer picture about potential victims online.
In the past, this large amount of data might be difficult to process. With AI doing the analysing today, triangulating users who live in certain parts of Singapore should not be hard.
Earlier this year, I received a letter from SLA that I was among the 70,000 people affected by data leaked from its records. Nothing to be done, since the data was gone. Just be careful, was the advice.
A similar notice arrived yesterday evening from M1, which I had been contracted to previously for mobile and broadband services, about my data being exposed. Again, a message to be vigilant. Thank you for your understanding.
This isn’t good enough. Each time an organisation like M1, Doctor Anywhere or SLA loses personal data, it increases the chances of a scammer swindling a victim.
In my case, hackers could call me up, pretending to be a bank by reading out its “records” of my name, NRIC, and address. Actually, that had happened recently.
A friend told me she experienced a similarly unnerving call, where a scammer knew all the personal details she’d usually only give to a bank or telco.
The SLA, as a government agency, does not face any fines for a data leak. M1 and Doctor Anywhere, if found guilty of negligence, could be fined like other private organisations.
Can these fines be used for something more constructive? Perhaps more public education campaigns and instructional workshops to keep people from being scammed, by explaining the ins and outs of how scammers work?
While raids on scammer compounds in nearby Southeast Asian countries mean the amounts scammed from Singapore have reduced this year, this is no time to think the threat has lessened.
Worryingly, it’s unclear if people are aware that their personal data is likely to be traded somewhere on the Dark Web for future scams.
With large exposures affecting a good part of the population, you should assume all your basic personal information, like those leaked at M1 this time, is already out there for scammers to use against you.
The public has to better understand the risks involved each time a data breach occurs. Here, the authorities should do more.
An organisation hit by a data breach should clearly state that the stolen information is often used by scammers to identify and target users. Explain the risks have gone up, not just to “be vigilant”.
Unfortunately, there is usually little recourse for people whose data is lost in such instances.
It’s true that data breaches will occur – just like cyberattacks – but it’s time that organisations that users have trusted did more to mitigate the increased risks caused by a leak.
Certainly, the risks have grown with more data exposed more frequently. With AI, including deep fakes, becoming common in future, it’s no time to let one’s guard down.
