Courts fined $178,000 for massive data leak affecting close to 1 million customers, employees

A ransomware attack in Sept 2022 on Courts’ system led to a massive data leak affecting 946,972 customers and employees.

Published Nov 03, 2026, 05:02 PM

Updated Nov 03, 2026, 05:19 PM

SINGAPORE – Electronics and furniture retailer Courts has been fined $178,000 over a ransomware attack that compromised the personal data of nearly one million people, marking its third breach of data protection obligations since January 2019.

The Sept 2022 attack affected 946,972 people, comprising 941,513 customers and 5,459 current, former and prospective employees, according to a Personal Data Protection Commission (PDPC) decision dated Aug 11 and published on its website on Oct 26.

Among the most sensitive information affected were employees’ bank account details and information about their creditworthiness. Customer data included names, identification numbers, addresses, phone numbers and, for some, the last four digits of credit card numbers.

The attacker was said to have broken into Courts’ network around Sept 21, 2022, through servers intended to keep its business running if its main systems failed.

Two of these disaster recovery servers were accessible over the internet. Investigations indicated that the attacker scanned for vulnerable network entry points and repeatedly attempted to gain access, before obtaining a system administrator’s login credentials through unknown means.

Connections between the disaster recovery servers and the rest of Courts’ network then allowed the attacker to reach other systems.

Ransomware was installed on 26 servers, fully or partially encrypting data on 20 servers . Courts detected malware around Sept 26.

On Oct 1, a customer service employee received a ransom demand seeking an unspecified payment for a password to recover the encrypted files. Courts did not respond, and no further contact from the attacker was reported.

To contain the incident, remedial measures included isolating affected servers, restoring systems from clean backups, installing security updates and tightening access controls were taken.

There was no evidence that the affected data had been taken out of Courts’ systems. Monitoring of the dark web and internet for 12 months also found no signs of public disclosure.

The PDPC found that Courts had failed to conduct security checks that could that could have uncovered and addressed the weaknesses exploited in the attack.

The retailer had excluded its recovery servers from regular vulnerability scans because it did not consider them critical, as they were not routinely used for business operations.

The commission rejected this reasoning, noting that the servers provided access to other systems holding large volumes of personal data.

Courts also failed to ensure timely security updates. The two internet-facing recovery servers had not received the latest patches since July 6, 2022, while multiple other servers ran outdated operating systems such as Windows Server 2008, which Microsoft had stopped supporting in January 2020.

In determining the fine, the PDPC considered the scale of the incident, the sensitivity of employees’ financial information and Courts’ repeated failures despite two earlier penalties.

In a statement, Courts accepted the decision and apologised to affected customers and staff. It said it had strengthened its security measures, engaged cybersecurity specialists to investigate the incident and appointed an external vendor to review the affected data.

It also set up a support channel at corpcomms@courts.com.sg .

Courts notified affected employees because their financial information had been accessed without authorisation by the hackers. It did not notify customers, assessing that their affected information was unlikely to cause significant harm.

This is not Courts’ first data protection breach.

In 2020, Courts was fined $9,000 after a faulty link in a membership email sent to 76,844 customers allowed users to access another member’s account without authentication.

In January 2019, it was fined $15,000 over a website flaw that exposed customers’ phone numbers and residential addresses to anyone entering a matching email address on its guest checkout page.

The PDPC said: “The Organisation’s systemic failings to implement basic cybersecurity policies and practices such as security reviews and patch management despite the previous financial penalties, warrant a higher financial penalty for more effective deterrence.”

Personal Data Protection Act

2022 年 9 月，法院系统遭受勒索软件攻击，导致大规模数据泄露，影响了 946,972 名客户和员工。

发布于 2026 年 11 月 3 日下午 5:02

更新于2026年11月3日下午5:19

新加坡——电子产品和家具零售商 Courts 因勒索软件攻击导致近一百万人的个人数据泄露而被罚款 17.8 万美元，这是该公司自 2019 年 1 月以来第三次违反数据保护义务。

根据个人数据保护委员会 (PDPC) 8 月 11 日作出的决定（该决定于 10 月 26 日在其网站上公布），2022 年 9 月的攻击影响了 946,972 人，其中包括 941,513 名客户和 5,459 名现任、前任和潜在员工。

受影响最敏感的信息包括员工的银行账户信息和信用记录。客户数据包括姓名、身份证号码、地址、电话号码，以及部分客户信用卡号的后四位。

据称，攻击者于 2022 年 9 月 21 日左右入侵了 Courts 的网络，入侵的服务器旨在使其业务在主系统发生故障时能够继续运行。

其中两台灾难恢复服务器可通过互联网访问。调查显示，攻击者扫描了网络漏洞入口点并反复尝试获取访问权限，最终通过未知手段获取了系统管理员的登录凭证。

灾难恢复服务器与法院网络其他部分之间的连接随后使攻击者能够访问其他系统。

勒索软件被安装在26台服务器上，其中20台服务器上的数据被全部或部分加密。法院在9月26日左右检测到了恶意软件。

10月1日，一名客服人员收到勒索信，要求支付一笔数额不详的赎金以换取恢复加密文件的密码。法院未对此作出回应，攻击者也未再与该员工联系。

为控制事件，采取的补救措施包括隔离受影响的服务器、从干净的备份中恢复系统、安装安全更新和加强访问控制。

没有证据表明受影响的数据已从法院系统中删除。对暗网和互联网长达12个月的监控也未发现任何公开披露的迹象。

PDPC发现法院未能进行安全检查，而这些检查本可以发现并解决攻击中被利用的漏洞。

该零售商已将其恢复服务器排除在常规漏洞扫描之外，因为它认为这些服务器并不关键，因为它们并非用于日常业务运营。

委员会驳回了这一理由，并指出这些服务器提供了对其他存储大量个人数据的系统进行访问的途径。

法院也未能确保及时进行安全更新。两台面向互联网的恢复服务器自2022年7月6日以来就未收到最新补丁，而其他多台服务器则运行着过时的操作系统，例如微软已于2020年1月停止支持的Windows Server 2008。

在确定罚款金额时，PDPC 考虑了事件的规模、员工财务信息的敏感性以及法院尽管此前已作出两次处罚却屡次失职的情况。

Courts在一份声明中接受了判决，并向受影响的客户和员工致歉。声明称，公司已加强安全措施，聘请网络安全专家调查此次事件，并指定外部供应商审查受影响的数据。

它还设立了支持渠道，邮箱地址为corpcomms@courts.com.sg。

法院通知了受影响的员工，因为他们的财务信息未经授权被黑客获取。法院没有通知客户，因为评估认为客户信息泄露不太可能造成重大损害。

这并非法院首次发生数据保护违规事件。

2020 年，Courts 公司因向 76,844 位客户发送的会员电子邮件中的一个错误链接，导致用户无需身份验证即可访问其他会员的帐户，而被罚款 9,000 美元。

2019 年 1 月，该公司因网站漏洞被罚款 15,000 美元，该漏洞会导致客户的电话号码和住宅地址暴露给任何在其访客结账页面上输入匹配电子邮件地址的人。

PDPC表示：“尽管之前已受到经济处罚，但该组织在实施基本的网络安全政策和实践（例如安全审查和补丁管理）方面仍存在系统性缺陷，因此需要处以更高的经济处罚，以起到更有效的威慑作用。”

个人数据保护法