SPH Media hit by AI-enabled cyberattacks; subscribers' names, phone numbers accessed

Preliminary investigations suggest the intrusions, which targeted five internal systems between Nov. 4 and Nov. 8, may have been artificial intelligence-enabled operations orchestrated by a single threat actor, reported The Straits Times .

The publisher confirmed that the compromised data predominantly comprised email addresses, along with some names, mailing addresses, and phone numbers. Certain employee email addresses were also accessed.

SPH Media stressed that no financial data, payment card details, banking information, passwords, or customer accounts were compromised in the breach, and no corporate customer data was affected.

“SPH Media takes the security and confidentiality of customers’ information very seriously, and has been working very closely with the relevant authorities and third-party specialists,” a company spokesman said.

According to the group, the vulnerabilities stemmed from a combination of software bugs and system configuration weaknesses.

The first breach was detected on Nov 4, followed by subsequent activity culminating in the latest detected incident on Nov 8.

Upon detecting the intrusions, the organisation engaged third-party cybersecurity specialists to contain the breach and secure the compromised systems. SPH Media has since patched software bugs, updated system configurations, reinforced perimeter defences against further network probing, and raised internal threat-monitoring levels.

The incident has been formally reported to the Personal Data Protection Commission (PDPC), the Cyber Security Agency of Singapore (CSA), and the Infocomm Media Development Authority (IMDA).

A police report has also been lodged.

Recipients were advised to watch for unsolicited messages, avoid opening suspicious links or attachments, verify delivery-related notices through official channels, and enable multi-factor authentication across their online accounts.