SPH Media hit by AI-enabled cyberattacks; subscribers' names, phone numbers accessed

SPH Media has been struck by a series of coordinated cyberattacks that compromised approximately nine per cent of its customer database, exposing subscriber contact details and personal information, the company announced today (Nov. 10).

Preliminary investigations suggest the intrusions, which targeted five internal systems between Nov. 4 and Nov. 8, may have been artificial intelligence-enabled operations orchestrated by a single threat actor, reported The Straits Times.

The publisher confirmed that the compromised data predominantly comprised email addresses, along with some names, mailing addresses, and phone numbers. Certain employee email addresses were also accessed.

SPH Media stressed that no financial data, payment card details, banking information, passwords, or customer accounts were compromised in the breach, and no corporate customer data was affected.

“SPH Media takes the security and confidentiality of customers’ information very seriously, and has been working very closely with the relevant authorities and third-party specialists,” a company spokesman said.

According to the group, the vulnerabilities stemmed from a combination of software bugs and system configuration weaknesses.

The first breach was detected on Nov 4, followed by subsequent activity culminating in the latest detected incident on Nov 8.

Upon detecting the intrusions, the organisation engaged third-party cybersecurity specialists to contain the breach and secure the compromised systems. SPH Media has since patched software bugs, updated system configurations, reinforced perimeter defences against further network probing, and raised internal threat-monitoring levels.

The incident has been formally reported to the Personal Data Protection Commission (PDPC), the Cyber Security Agency of Singapore (CSA), and the Infocomm Media Development Authority (IMDA).

A police report has also been lodged.

Subscribers urged to look out for scam attempts

In direct notifications sent to affected subscribers, SPH Media issued an apology and urged readers to stay alert against potential phishing campaigns and scams exploiting the leaked information.

“While the exposed information does not include financial details or passwords, it could potentially be used for phishing or scam attempts,” the company warned in an email to subscribers.

Recipients were advised to watch for unsolicited messages, avoid opening suspicious links or attachments, verify delivery-related notices through official channels, and enable multi-factor authentication across their online accounts.

Affected subscribers seeking assistance or looking to verify suspicious communications can contact SPH Media's customer service team via its official website or at 6388 3838.