Ezynetic Pte. Ltd. is a Singapore-based company that operates as a software-as-a-service (SaaS) provider. The company provides information technology solutions and services to licensed money lending companies in Singapore. Their system is connected to the Moneylenders Credit Bureau (MLCB) platform managed by the Singapore Credit Information Company[1].
On June 26, 2024, the Singapore Personal Data Protection Commission (PDPC) was notified of a data breach involving the company's servers infected with ransomware[2] around June 24, 2024. As a result, the personal data of 190,589 individuals was stolen and posted for sale on the dark web[3].
Source: NCMEP
Previously, on March 24, 2024, VNDIRECT Securities Company was attacked on March 24, 2024 by an international hacker group, paralyzing the company's online trading system. This incident has made it impossible for investors to log in, trade and check accounts.
It can be said that these are typical cases for the case of a business's system being attacked by malware to steal data.
What are the reasons for businesses being attacked by malware?
The case of Singapore's Ezynetic Company being hacked and data theft stemmed from the following reasons:
Firstly, the Web Service application corruption vulnerability
According to PDPC's investigation, the attacker exploited a vulnerable web service application to access and control SA accounts[4] on the Company's SQL Server database server. Ezynetic's money lending system connects to the MLCB platform via API, [5]allowing customers to enter personal data (name, address, NRIC, financial information) for credit checks and loan tracking. The vulnerability is located at the web application layer, which handles API requests, allowing an attacker to perform unauthorized access without strong authentication.
Once accessed, the attacker deletes and steals the database, then encrypts the system with ransomware to demand a ransom and threaten to make the data public.
Second, weak security of SA accounts
SA account – a default account in SQL Server with system-wide admin rights, including reading/writing/deleting any data, has not been properly disabled or secured by the company. The proof is that the password at the time of the incident was "p@ssword1" or "Password@1", a common variation of the default password, which is susceptible to guessing or mass password attempt attacks. The PDPC emphasizes that SA is "one of the riskiest accounts" because it allows every activity to be carried out without the need for additional authentication.
SA permissions allow an attacker to access the entire lending system, stealing sensitive customer data without triggering an alert.
Third, lack of vulnerability assessment and periodic inspections
The company does not perform any periodic vulnerability assessments or penetration tests for the infrastructure. This leads to web service vulnerabilities and weak passwords not being detected in time. In the absence of audits, the Company does not recognize the risk from the SA account or web service, resulting in the entire system being compromised in just a few days.
Source: Ezynetic
Ezynetic's actions to explain incidents and lessons for Vietnamese businesses
After the theft and data encryption incident was discovered, Ezynetic quickly took measures:
Incident isolation: As soon as the SIEM (Security Information and Event Management) monitoring system detects, Ezynetic immediately isolates the affected system to prevent the spread.
Notification and cooperation with authorities: Ezynetic notified customers on July 1, 2024, just one week after the incident, and cooperated with PDPC to handle the incident and help reduce financial penalties.
Remediation and recovery: Ezynetic has also developed an incident response plan that includes periodic data backups and recovery checks. Ezynetic moved to the cloud and consulted the Cybersecurity Agency of Singapore (CSA) as well as Singapore's Ministry of Justice, a step that was highly appreciated by the PDPC.
Post-incident assessment and improvement: After treatment, conduct an analysis of the root cause of the incident to avoid recurrence.
These actions show that Ezynetic responds promptly to mitigate further risks. This is something that businesses pay close attention to. Incident prevention is still a priority, but when an incident occurs, it shows responsibility to the violated person and cooperates with the authorities to handle it as soon as possible and minimize the consequences for the violation. very important.
To avoid similar incidents, businesses that handle sensitive data need to prioritize prevention, considering this as the cornerstone of their cybersecurity strategy. From Ezynetic's case and similar cases to VnDirect's, we propose some of the following solutions for businesses to prevent and limit similar incidents:
Strengthen access control and password management: Weak passwords are a common "gateway" for hackers. Businesses should adopt a strong password policy, consisting of at least 12 characters, a combination of letters, numbers, special characters, and periodic changes (every 3-6 months). Use multi-factor authentication (MFA) for important accounts, especially admin accounts. In the Ezynetic case, the failure to disable or secure the SA account led to a serious incident. In Vietnam, the Personal Data Protection Law 2025 stipulates that organizations must "protect personal data from the risk of unauthorized access", so implementing MFA is not only a recommendation but a legal obligation.
Perform vulnerability assessments and periodic penetration tests: Ezynetic does not conduct any pre-incident tests, resulting in an exploited web vulnerability. Businesses should hire experts or use tools to scan the system quarterly. Penetration testing should be performed at least once a year. Article 15 of the Personal Data Protection Law 2025 requires organizations to "take appropriate technical and organizational measures to protect data," including periodic risk assessments.
Build a data classification and encryption system: Sensitive data such as financial information needs to be classified and encrypted when stored or transmitted. In the Singapore case, credit data was not adequately protected. In Vietnam, the Law on Personal Data Protection defines sensitive data to include financial information, health, and special processing requirements, including notifying data subjects when there is a risk.
Train employees and build a security culture: Employees are the first "shield". Organize training courses on identifying and using secure passwords, as well as providing instructions for reporting incidents. Ezynetic could have been avoided if employees had detected abnormal signs early.
The Ezynetic case is a wake-up call for businesses that handle sensitive data that prevention is always cheaper than remediation. With the Law on Personal Data Protection 2025, Vietnam is building a solid legal framework, requiring businesses to act proactively. By applying both legal and technical measures, businesses not only avoid the risk of cyber attacks but also comply with the law, contributing to building a safe digital environment.
[1] https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/commissions-decisions/gd_ezynetic-pte-ltd_03032025.pdf, accessed on 10/12/2025.
[2] Ransomware is malware that encrypts your files or prevents you from using your computer until you pay (ransom) for them to be unlocked. If your computer is connected to a network, ransomware can also spread to other computers or storage devices on the network.
[3] The dark web is a hidden part of the Internet, not indexed by conventional search engines such as Google, requiring access to a specialized browser such as Tor, providing high anonymity for both legal (journalists, activists) and illegal (prohibited trade, etc.). cybercrime), which relies on anonymous networks such as the Tor Network to encrypt and conceal user identities.
[4] This is the highest administrator account, which has access to and control everything in SQL Server, used to install, configure, and manage databases.
[5] An API (Application Programming Interface) is a set of rules and protocols, which serves as a bridge that makes it possible for different software applications to "talk", exchange data, and interact with each other in a structured and automated manner, just like an intermediary server that receives requests and returns results to you, without you needing to know the details of how the kitchen (server) works. APIs allow systems to connect and share information (e.g., a weather app using a weather service's API, or a social media app using an API for posting), making app integration and development much easier and more efficient.
