ShopBack Investigating Incident Involving ‘Unauthorised Access’ to Customers’ Personal Data

SINGAPORE: Online cashback portal ShopBack said it has initiated an investigation after being alerted to an incident involving “unauthorised access” to its systems containing customers’ personal data.

In an email to its customers on Friday (Sep 25) seen by CNA, ShopBack said it was currently confirming what data had been compromised.

“To date, we have no reason to believe that any of your personal data has been misused, however the possibility still exists,” said the Singapore-based company.

Customers’ cashback balances or unutilised vouchers were also not affected by the incident, said ShopBack in an FAQ page on its mobile app.

“Your credit cards are safe as we do not store your 16-digit card number or CVV on any of our systems,” it added.

ShopBack said customers may continue to access their accounts as business operations have not been affected.

But the company encouraged customers to reset their passwords as a precautionary measure, even though the existing ones are encrypted.

Also Read: Do Not Call Registry Penalty: Important Tips To Consider

“Unsettling News”

On its FAQ page, ShopBack said that apart from email addresses and “limited transactional information”, the company does not have additional data that customers had not provided directly. 

Types of data that may have been provided to ShopBack include names, contact information, gender, date of birth, identification numbers, and bank account numbers. 

“As soon as we became aware of the issue, the unauthorised access was removed,” said the company. 

“We immediately initiated an investigation and engaged leading cybersecurity specialists to assess the extent of the incident and to further enhance our security measures,” said ShopBack, adding that it was also collaborating with relevant authorities.

The company has also tightened the monitoring of internal logs to “ensure heightened detection of unauthorised access if any were to occur”, it said. 

“We recognise that this is unsettling news and we are deeply sorry for any inconvenience this might cause you,” said the company. 

“The security and privacy of our customers is of utmost importance to us, and we commit to taking all the steps we can to minimise the risk of a similar incident occurring again in the future.” 

In response to CNA queries about how many customer accounts have been affected, ShopBack’s spokesperson on Saturday said that the company is still confirming exactly what data has been compromised.

“We have initiated an investigation and at this point we are confirming exactly what data has been compromised. We will communicate again when we have further information,” said the spokesperson.

The Personal Data Protection Commission said it has been notified of the incident, adding that investigations are ongoing.

Also Read: Top 8 Main PDPA Obligations To Boost And Secure Your Business