SPH Media: five internal systems breached 4-8 Nov; mostly email, name and phone data accessed
Severity: medium · Patch status: patched · Since 2026-11-10
On 10 November 2026 SPH Media, a Singapore media group, said attackers hit five of its internal systems between 4 and 8 November, which it believes was a concerted effort by one threat actor. Its preliminary view is that the intrusions may have been AI-enabled operations; it attributes them to a mix of software bugs and system configuration weaknesses, which it says it has since fixed, with perimeter defences reinforced. The company says about 9% of its database was affected, without saying which database. The exposed data is mostly email addresses, plus some names, postal addresses and phone numbers. Employee email addresses were accessed; outlets disagree on whether corporate-customer addresses were (The Star says yes, Mothership and Yahoo say no corporate customer data was affected). SPH says no payment card, banking or financial information, passwords or customer accounts were compromised, and its news sites and subscription services were unaffected. The five systems are not named; SPH describes two groups of in-house systems, one holding some personal data and one holding none. It has reported the incident to the Personal Data Protection Commission, the Cyber Security Agency of Singapore and the Infocomm Media Development Authority, and has filed a police report. No threat actor is named, and the AI-enabled attribution is unconfirmed.
What to do
- Watch for phishing that uses SPH Media subscriber or staff email addresses, names or phone numbers
- Treat unsolicited SPH-branded messages asking for logins or payment as phishing; SPH says passwords were not compromised
- Review whether staff corporate subscriptions or accounts use SPH Media addresses and watch them for follow-on phishing
- Watch SPH Media and the PDPC for the threat actor's name and any update on the ~9% of database affected
- Harden internet-facing systems against the two weakness classes SPH cites: software bugs and system configuration
Sources
All live incidents on Threat Watch
