Simba Telecom Reports Data Breach Affecting Over 23,500 Customers in Singapore Singapore-based telecommunications provider Simba disclosed a data breach on September 25, impacting 23,549 customers. The compromised data includes names, identity card numbers, dates of birth, mobile numbers, and email addresses information tied to customers who registered for the company’s services. The breach was detected on September 24, and Simba stated that the incident had been resolved by the time of the announcement. While no credit card or bank account details were exposed, the company acknowledged the potential risk of the stolen personal data being misused, though it reported no evidence of malicious exploitation at this stage. Simba emphasized its response, noting that it had reinforced security measures to protect its infrastructure and systems. The company is collaborating with relevant authorities and has begun notifying affected customers via email, with the process expected to conclude within a week.

Singapore’s Major Telcos Targeted by State-Linked Cyberespionage Group UNC3886 On February 9, Singapore’s Minister for Digital Development and Information, Josephine Teo, disclosed that all four of the country’s major telecommunications providers Singtel, StarHub, M1, and Simba Telecom were targeted by the advanced persistent threat (APT) group UNC3886, a China-linked cyberespionage actor. First identified in 2022 by cybersecurity firm Mandiant, UNC3886 is known for its persistent, sophisticated attacks aimed at intelligence gathering and long-term surveillance. The group employs zero-day exploits vulnerabilities unknown to vendors to infiltrate network devices, virtualization systems, and critical infrastructure. It also uses custom malware and legitimate system tools to evade detection, making it particularly difficult to counter. While no sensitive data was confirmed to have been exfiltrated, authorities warned of the potential fallout. A successful breach could disrupt telecom and internet services, cascading into sectors like banking, finance, transport, and healthcare all part of Singapore’s 11 critical services sectors. Minister Teo emphasized that even limited access could erode trust in Singapore’s digital infrastructure and economic security. The Cyber Security Agency of Singapore (CSA) and the Infocomm Media Development Authority (IMDA) revealed that UNC3886’s activities were detected in parts of the country’s critical information infrastructure as early as July 18, 2025. Though the group managed to steal a small amount of technical data, 5G networks and other core systems remained uncompromised due to separate security measures. UNC3886 has a history of targeting high-value sectors globally, including government, defense, energy, and telecommunications. Past attacks have exploited vulnerabilities in Juniper Networks routers, Fortinet security devices, and VMware virtual machines. The group’s persistence was underscored by Minister Teo, who noted that even if detected and removed, UNC3886 would likely attempt re-entry. The incident follows a pattern of escalating cyber threats against Singapore. Previous APT attacks include the 2014 breach of the Ministry of Foreign Affairs, the 2017 intrusions at NUS and NTU (targeting government-linked research), and the 2018 SingHealth data breach, which exposed the personal data of 1.5 million patients, including then-Prime Minister Lee Hsien Loong. More recently, in 2024, a global botnet infected 2,700 devices in Singapore, though no critical infrastructure was affected. While Singapore’s defenses prevented significant damage in this case, authorities stressed that the threat remains ongoing, with UNC3886’s tactics continuing to evolve.