Marina Bay Sands fined $243,000 for data breach

Marina Bay Sands has been fined S$315,000 (US$243,000) for a data breach that impacted over 665,000 customers in October 2023.

The amount is based on the amount earned by the operator, with a 2022 ruling allowing for fines up to 10% of annual turnover to be imposed against operators making more than S$10m. It also accounted for Marina Bay Sands' admission to the breach, and its immediate action to fix the matter.

The fine, imposed by the Personal Data Protection Commission (PDPC), comes as a result of a breach of the Protection Obligation under the Personal Data Protection Act, as determined by the Personal Data Protection (Amendment) Bill 2021.

The breach saw over 665,000 Marina Bay Sands customers' data illegally accessed by unknown threat actors. This data, which included names and contact details, was later found for sale on the dark web, making this data accessible to phishing scammers and identity thieves.

The breach was possible due to a combination of factors. A large-scale software migration in March 2023, combined with Marina Bay Sands' admitted breach of the Protection Obligation (Sands said it had 'failed to take reasonable security measures to protect the personal data in its possession', according to the PDPC).

On a more technical level, during the migration, security policies had to be imposed across all Marina Bay Sands platforms, including its application programming interfaces. One interface, the Art Science Friends webpage, was omitted during the move, not receiving the necessary checks to ensure no data could leak. This was in part due to Marina Bay Sands' handling of the move. Indeed, the move was assigned to just one employee, who had to compile the list of interfaces manually, all without a second layer of checks.

This oversight was not detected for six months, allowing bad actors to access and exploit player data.