Loading story…
Singapore telecommunications provider Simba disclosed that a breach discovered on September 24 compromised the personal information of 23,549 registered customers. Exposed records included names, identity-card numbers, dates of birth, mobile-phone numbers, and email addresses; Simba said no credit-card or bank-account information was at risk.
The company said it contained and resolved the incident, reviewed security measures across its core infrastructure and systems, and is notifying affected customers by email. Singapore’s Personal Data Protection Commission has been notified and is investigating; neither the responsible actor nor the intrusion method has been publicly identified.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Simba disclosed that names, identity card numbers, dates of birth, mobile numbers, and email addresses of 23,549 customers had been compromised. It said no credit-card or bank-account information was at risk and that it had no indication of malicious misuse of the leaked data.
Simba discovered a breach compromising personal data of customers registered for its services and said it swiftly resolved the incident. The breach ultimately affected 23,549 individuals.
Singapore's Personal Data Protection Commission became aware of the incident and began investigating. Simba began notifying affected customers by email and said it was working with authorities and reviewing protections for its core infrastructure and systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
straitstimes.com
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Carnival Corporation disclosed a data breach after a threat actor used social engineering to compromise an employee account and gain unauthorized access to a limited portion of the company’s internal IT systems. The company said it detected suspicious activity on April 14, contained the intrusion with help from third-party cybersecurity specialists, and confirmed by April 22 that customer personal information had been copied from affected systems. The exposed data included names, addresses and other contact details, dates of birth, government-issued identification numbers linked to passports and driver’s licenses, and in some cases Social Security numbers. Reports said about **6 million** people in the United States may be affected. Carnival began notifying impacted individuals on May 27, issued a public notice for people it could not contact directly, and is offering **24 months** of complimentary credit monitoring through **TransUnion MyTrueIdentity**. The company has not identified the threat actor or said whether ransomware or extortion was involved.
Jun 29, 2026
**Tenga** disclosed a data breach after an attacker gained unauthorized access to a single employee’s professional email account, allowing visibility into the mailbox contents and enabling outbound spam/phishing to the employee’s contacts, including customers. The exposed information potentially included customer **names, email addresses, and historical email correspondence**, which may have contained **order details** or customer service inquiries; Tenga said a forensic review determined the incident affected **approximately 600 U.S. customers**. Tenga characterized the incident as localized and limited in scope, stating its broader systems and databases outside the U.S. were not impacted and that **no Social Security numbers, payment card data, billing information, or store passwords** were compromised. Post-incident actions described included resetting the affected employee’s credentials and implementing or expanding **multi-factor authentication** across systems; customers were advised to remain vigilant for suspicious emails and consider changing passwords as a precaution, particularly for messages appearing to come from the impacted employee account.
Jun 29, 2026
National Public Data disclosed a security incident affecting a large repository of consumer background-check and people-search information, with exposed data reported to include highly sensitive personal identifiers such as **Social Security numbers**, names, mailing addresses, and other profile details. The company published a breach notice on its website, while an individual notification letter filed with the California Attorney General indicates affected residents were formally notified that their information may have been involved. The incident drew attention because the compromised records appear to involve data commonly used for identity verification and fraud, increasing the risk of **identity theft**, account takeover, and social-engineering abuse. The notification materials show the breach response included direct notice to impacted individuals and guidance on protective steps such as monitoring accounts and credit activity, underscoring the seriousness of the exposure for consumers whose records were held by the data broker.
Jul 12, 2026