'I am deeply sorry': MoneySmart CEO apologises after data breach; affected customers speak out

MoneySmart chief executive officer Vinod Nair has apologised following a data breach that affected some customers in Singapore and Hong Kong, after an unauthorised third party accessed the financial platform's internal IT systems and copied personal data.

Affected users received emails from MoneySmart on Nov 3, informing them that an unauthorised third party had accessed internal IT systems, resulting in personal data being copied.

The company said it discovered the incident on Oct 29.

Two AsiaOne readers, a man and a woman who declined to be named, said their names, email addresses and mobile numbers were compromised in the breach.

"I was concerned when I learned the breach, especially because personal information can be used in targeted scams," said the man.

"Data breaches are a known risk, but it is still worrying when it affects you personally."

While neither reader reported any financial losses, the male reader said he is now taking extra steps to be careful with messages and calls, verifying requests through official channels and monitoring his bank transactions for suspicious activity.

Meanwhile, the woman said she noticed an increase in phishing messages in the days leading up to news of the data breach, as well as an attempted login to her Trip.com account. She added that she had previously purchased travel insurance through MoneySmart.

She is now actively ignoring phishing messages and reporting incidents as they happen, she said.

On whether he intends to continue using MoneySmart, the man said he is taking a wait-and-see approach while assessing how the company strengthens its security measures.

"The MoneySmart incident is a reminder that even basic personal information, such as names, email addresses and phone numbers, can be used to make scams more convincing," he said.

"Affected users should be cautious of unexpected messages, avoid sharing one-time passwords, and verify requests directly through official channels."

MoneySmart CEO apologises

"I am deeply sorry to everyone affected," the platform's chief executive officer Vinod Nair said in a statement.

"Customers trust us with information their financial lives, and we take that responsibility very seriously."

Nair said the company moved quickly to stop the unauthorised access and secure its systems after discovering the incident.

In the email to customers seen by AsiaOne, MoneySmart said the incident had been reported to relevant authorities, including the Personal Data Protection Commission (PDPC), the Monetary Authority of Singapore (MAS) as well as the Office of the Privacy Commissioner for Personal Data in Hong Kong.

The company has also engaged independent cybersecurity and forensics experts to investigate the incident.

MoneySmart added that it is contacting affected customers directly to explain what data was involved and the steps they can take to protect themselves.

"MoneySmart continues to operate as normal, and we are committed to supporting our customers," Nair said.

He added: "We are reviewing everything that led to this incident and making the changes needed to prevent it from happening again."

AsiaOne has contacted MoneySmart, the PDPC and MAS for more information.

[email protected]