for early access to the latest igaming videos!
and get the latest igaming news first!
Marina Bay Sands Pte Ltd, the operator of Marina Bay Sands resort complex based in Singapore, has been fined SG$315,000 (or US$243,400) by the Personal Data Protection Commission (PDPC) for the huge 2023 data leak of 665,495 personal data of Sands Lifestyle Rewards program members.
Breach Details and Impact
The incident occurred while conducting a mass software migration exercise in March 2023. MBS did not follow the proper security policies in copying data from the previous system to the new system. In particular, an identifier corresponding to the ArtScience Friends webpage was not included, and the system remained exposed to malicious users.
Consequently, unauthorized third parties broke into and copied patrons’ personal data such as names, email addresses, phone numbers, countries of residence, membership levels, and numbers. Luckily, the information concerning the Sands Rewards Club, which is casino rewards, was found to be untouched. However, the stolen personal information was subsequently found to be on sale on the dark web.
PDPC Findings and Criticism
The Commission cited MBS’s lack of proper security measures as a negligent violation under the Personal Data Protection Act (PDPA). Even with high risks involved, MBS only had one employee manually create the configuration list for Application Programming Interfaces (APIs) without secondary verification procedures. This loophole was left undiscovered for six months, and personal data was left vulnerable.
Being a highly capitalized big company, the PDPC indicated that Marina Bay Sands ought to have had adequate measures in place to avoid such breaches. The fine is a culmination of the gravity and magnitude of the data breach, coupled with the inability to identify and address the security vulnerability in a timely manner.
Wider Cybersecurity Environment within Hospitality
The breach at Marina Bay Sands is a follow-up to a period in which other major integrated resort operators worldwide were also affected by cyberattacks, such as US giants MGM Resorts and Caesars Entertainment. The incidents serve as a reflection of the increasing cybersecurity threats to major operators in the gaming and hospitality industry worldwide.
Post-Breach Actions
Marina Bay Sands retaliated by carrying out investigations with cybersecurity professionals and applying prompt improvement actions. The resort has promised affected members of the Sands Lifestyle Rewards program that it will send personal notices with instructions to assist in protecting against possible phishing scams and attempts at identity theft brought about by the data breach.
Significance of the Enforcement of Data Protection
The penalty also indicates Singapore’s seriousness in applying strict data protection requirements under the PDPA, particularly to large-scale companies that deal with sensitive customer data. Revised penalties in the Commission’s Financial Penalty Framework look to deter carelessness and spur good cybersecurity measures
This incident is a reminder to all companies to strictly apply safe data handling protocols during crucial IT changes and have continuous monitoring systems against new digital risks.
Source: Inside Asian Gaming (IAG)
