A data breach that affected 665,000 clients was revealed by Singapore's renowned integrated resort, Marina Bay Sands. Some of the customer's loyalty programme membership data was discovered to have been accessed by an unauthorised third party. The company's inquiry has not revealed any proof that an unauthorised third party has exploited the data to damage clients. The business has already reported the occurrence to the appropriate authorities in Singapore and, if necessary, other nations, and will contact the affected customers.

Marina Bay Sands, a Singapore-based casino resort and subsidiary of Las Vegas Sands Corp, suffered a data breach in March 2023 during a large-scale software migration. Due to a technical identifier omission in a webpage, security policies were improperly configured, allowing malicious actors to illegally access and exfiltrate the personal data of 665,495 patrons, including names and contact details. The breach went undetected for six months until October 2023, when the data was discovered for sale on the dark web.The Singapore Personal Data Protection Commission (PDPC) imposed a SGD 315,000 (USD 243,200) fine for failing to implement reasonable security measures, citing negligence in migration processes—such as relying on a single employee without verification checks. While Marina Bay Sands admitted liability and reactivated security measures immediately upon discovery, the breach exposed over half a million customers' data, severely undermining trust. The incident highlights critical gaps in enterprise-level data protection during high-risk IT operations.

Marina Bay Sands (MBS) in Singapore was fined S$315,000 under the Personal Data Protection Act (PDPA) after a cybersecurity breach in October 2023 exposed the personal data of over 665,000 non-casino rewards programme members. The compromised data—including names, telephone numbers, countries of residence, membership numbers, and rewards programme tiers—was later found for sale on the dark web, increasing risks of phishing scams and identity theft.The breach occurred during a software migration, where MBS entrusted the process to a single employee without implementing second-layer security checks. This negligence allowed an unauthorised third party to access and exfiltrate the data illegally. Singapore’s Personal Data Protection Commission (PDPC) criticised MBS for failing to adopt adequate security measures, despite being a large enterprise with significant resources. The PDPC ruled that MBS ignored clear risks associated with the migration, violating the Protection Obligation under PDPA. The penalty was calculated under the 2021 Amendment Bill, which permits fines up to 10% of annual turnover for organisations with revenues exceeding S$10 million.