Translated by ChatGPT
Lianhe Zaobao 2026-11-13
By Yan Shi Pei (颜诗珮)
The author is a senior cybersecurity engineer.
=====
In the digital age, consumers have to provide some personal information, to varying degrees, whether they are shopping in physical stores or online, registering for membership, booking air tickets, receiving remote medical consultations, or applying to telecommunications companies to activate mobile phone lines. Once this information is handed over to third parties, it may be stored in different systems or cloud platforms, exposing it to potential data leakage risks.
Recently, several data breach incidents have been reported in Singapore in quick succession. First, Singapore Airlines disclosed that some passenger information had been leaked after its third-party booking system was accessed without authorisation. This was followed by disclosures of data breaches by telecommunications company M1 and telemedicine platform Doctor Anywhere, once again drawing attention to the security of consumers' personal information.
A data breach may only be the beginning of the risks. What truly causes victims to suffer financial losses, reputational damage, or even become embroiled in legal disputes is the subsequent "secondary exploitation" of leaked information by criminals, such as scams or identity theft. Therefore, consumers should not focus solely on whether their personal information has been leaked. More importantly, they should take preventive measures as early as possible to avoid becoming victims of subsequent scams.
As the saying goes, "Know yourself and know your enemy, and you will never be defeated in a hundred battles." To guard against secondary exploitation, we must first understand the various subsequent risks that may arise after a data breach. According to cybersecurity-related information published by the US National Institute of Standards and Technology (NIST) and the International Information System Security Certification Consortium (ISC2), leaked personal data may be retained by criminals for long periods, resold or reused repeatedly, creating ongoing risks of scams and identity theft.
Whether a data breach occurred recently or happened a long time ago, nobody can predict when secondary exploitation might occur. This is because criminals may piece together old and new information at any time to launch scams against the individuals concerned or impersonate their identities. Among the first risks is "spear phishing", in which criminals use genuine information they have stolen, such as personal travel itineraries, medical records or identity card numbers, to impersonate trusted organisations or relevant personnel and carry out phishing attacks. This makes fraudulent messages more credible and increases the likelihood of victims being deceived. In addition, criminals may impersonate victims to open accounts on platforms with less stringent verification procedures, make unauthorised online purchases, or even attempt to apply for loans, exposing victims to financial losses and the risk of identity theft.
Another risk is the domino effect of password leaks. If the same password is reused across multiple applications, once one account is compromised, criminals can exploit the opportunity by using automated programmes to log in to other online platforms under the same username with the leaked password.
Cybersecurity-related information from the Information Systems Audit and Control Association (ISACA) emphasises that, in response to data breach incidents, timely containment of risks, strengthening security protection and minimising losses are crucial. Since leaked information may already have fallen into the hands of criminals, defensive efforts should focus on reinforcing existing safeguards, protecting important accounts and assets, and preventing further losses.
To build a more comprehensive line of defence, members of the public can take action at the following four levels:
### Enable Passkeys Linked to Personal Devices
First, develop a habit of verification based on the "zero trust" principle to identify customised phishing scams. Even if the other party provides accurate details about personal travel itineraries, medical appointments or identity card numbers, one must remain vigilant. Cybersecurity experts generally emphasise the importance of out-of-band authentication. Whenever there are urgent requests involving unusual account activity, refunds or assistance with investigations, never disclose relevant information directly or click on links, QR codes or attachments in emails and text messages. Instead, verify the matter independently through official applications or by looking up the official hotline on the organisation's website.
Second, avoid using the same password for multiple accounts. Do not reuse the same set of passwords across different platforms. It is advisable to use a password manager to generate unique passwords for each platform. Where supported, give priority to enabling passkeys linked to personal devices, or activate two-factor authentication (2FA). Take Singpass, which is commonly used in Singapore, as an example. It now also supports passkeys. This feature uses biometric authentication on mobile phones for encrypted verification, completely eliminating the need for traditional passwords. Since passkeys only work with genuine official website addresses, even if users accidentally click on highly convincing phishing links, fake websites cannot initiate the verification process. Criminals therefore have no way of obtaining any login credentials.
Third, make good use of anti-scam tools provided by the Government and banks. Members of the public may consider installing ScamShield on their mobile phones to help block suspicious calls and identify and filter fraudulent text messages. After installation, follow the instructions to enable call-blocking and SMS-filtering permissions in the phone's system settings. Otherwise, the protection features will not take effect. If you receive a suspicious text message, telephone number or link, you can use the "Check for Scams" function within the ScamShield application to verify suspicious messages on WhatsApp and Telegram. You can also submit screenshots for checking.
In addition, the mobile applications of many local banks provide a Money Lock feature, which allows users to "lock" and isolate a specified amount of their deposits. Once locked, these funds cannot be transferred out through internet banking, mobile banking or PayNow. The unlocking procedures vary from bank to bank. Even if users unfortunately fall for highly convincing phishing messages or have their devices hijacked by malware in the future, the locked funds cannot easily be transferred remotely.
Fourth, activate the built-in security settings on mobile phones and learn the emergency procedures for dealing with an abnormal black screen. In the phone settings, disable the permission to "install unknown apps" to prevent unauthorised installation packages from being installed through websites or messaging applications. If you accidentally click on an unfamiliar link or install a suspicious programme and your phone screen suddenly goes black, leaving you unable to operate the device, immediately switch on airplane mode or press and hold the power button to shut down the phone. At the same time, use someone else's phone to contact your bank and activate the "kill switch" to freeze your account, and report the incident to the police as soon as possible.
Comprehensive digitalisation and cloud computing are inevitable trends in modern society. While businesses continue to strengthen supply chain security and fulfil their responsibilities for data protection, our immediate priority as individuals is to raise our awareness of preventive measures and take proactive steps to protect ourselves, so that we do not become victims of secondary scams.
Information source
Posts
