Ransomware Attack on Singapore Data Provider Exposes Policyholders’ Personal Information A ransomware attack on DataPost, a Singapore-based data handling service provider, has compromised the personal information of at least 146 Income Insurance policyholders. The breach, detected on May 27, involved the unauthorized exfiltration of sensitive data, including names, postal addresses, policy numbers, plans, and 2024 annual bonuses. DataPost, which processes over 40 million documents monthly for financial institutions, government agencies, and insurers, confirmed the attack on May 29 but stated that its investigation remains ongoing. The company, accredited by Singapore’s Infocomm Media Development Authority (IMDA) for its InvoiceNow e-invoicing network, handles critical document printing and mailing services, including those for Income Insurance. The attack was first flagged by cybersecurity platforms RedPacket Security and HookPhish, which identified the threat group “direwolf” as responsible. The group allegedly deployed infostealers malicious software designed to extract data in a coordinated operation. While ransomware typically encrypts files for extortion, this incident involved data theft, raising concerns over potential misuse. Income Insurance was notified of the breach on May 26 and immediately suspended all printing jobs with DataPost, reinforced firewall protections, and blocked connections to the vendor. The insurer stated there is no evidence of unauthorized access to its digital platforms but remains on “heightened alert” while working with authorities, including the Personal Data Protection Commission (PDPC) and the Cyber Security Agency of Singapore (CSA), to assess the full impact. DataPost, which undergoes annual security audits by banks and third-party assessors, has pledged full compliance with regulatory obligations. Both companies are coordinating with affected policyholders, though the scale and severity of the breach are still under investigation. The incident underscores the risks faced by third-party service providers in handling sensitive financial and personal data.