On 29 August 2021, we discovered that an unknown external party had obtained unauthorised access to a third-party data storage platform used by MyRepublic to store identity verification documents relating to the application for mobile services. Some of that data was downloaded without permission.
The unauthorised access to the data storage facility has since been secured, and the incident has been contained. We have also reported this incident to the Personal Data Protection Commission and the Infocomm Media Development Authority.
What personal data was accessed?
Based on our investigation, the unauthorised access affects only mobile subscribers based in Singapore.The affected data storage platform contained the following identity verification documents related to customer applications for mobile services:
- For affected Singapore citizens, permanent residents and employment and dependent pass holders — scanned copies of both sides of NRICs - this includes name, address, date of birth, gender, race, place of birth, full NRIC number, photograph, thumbprint, date of card issue and (for employment passes and dependant passes) employer and nationality;
- For affected foreigners — proof of residential address documents (e.g. scanned copies of a utility bill, tenancy agreement or insurance policy), including name and address; and
- For affected customers porting an existing mobile service — name and mobile number.
