Singapore Says Grab’s Fourth Privacy Breach Is Concerning

guest · Sep 16, 2020

Singapore Says Grab’s Fourth Privacy Breach Is Concerning
September 12, 2020
https://www.bloomberg.com/news/arti...ys-grab-s-fourth-privacy-breach-is-concerning

Singapore’s privacy regulator imposed a S$10,000 ($7,311) penalty on ride-hailing company GrabCar Pte for a personal-data breach incident last year and raised the alarm on repeated violations by the unit of Grab Holdings Inc.

In August 2019, an update of Grab’s mobile application exposed the personal data of more than 21,500 users to the risk of unauthorized access, according to the Personal Data Protection Commission. The breach, which included the profile pictures, names, wallet balance of users and vehicle plate numbers, was related to GrabHitch, a service that allows carpooling.
The glitch was fixed in less than an hour, according to the report.
Click to expand...

“Given that the organization’s business involves processing large volumes of personal data on a daily basis, this is a significant cause for concern,” Yeong Zee Kin, deputy commissioner for the Personal Data Protection Commission, said in the announcement dated Sept. 10.

Grab’s cooperation with the investigation and prompt, forthcoming responses to queries was a “mitigating factor” when arriving at the penalty amount, the regulator said.
Click to expand...

guest · Sep 16, 2020

Grab must review data policies following security breaches
September 16, 2020
https://www.zdnet.com/article/grab-must-review-data-policies-following-security-breaches/

Grab must reassess its cybersecurity framework, especially after the mobile app platform reported a series of breaches that compromised its customers' data.

In its report, the PDPC noted that Grab had made changes to its systems without ensuring "reasonable security arrangements" were put in place to prevent any compromise of personal datasets.
The commission noted that Grab had made changes to its app without understanding how such modifications would operate with existing features of its app and its broader IT system.
Click to expand...

ZDNet asked Grab several questions including specific areas the company planned to review, security policies it put in place following the initial breach, and steps it had taken to ensure security was built into its various processes as the company introduced new services in recent years.

It did not respond to any of these questions and, instead, replied with a statement it had previously released: "The security of data and the privacy of our users is of utmost importance to us and we are sorry for disappointing them. [...] To prevent a recurrence, we have since introduced more robust processes, especially pertaining to our IT environment testing, along with updated governance procedures and an architecture review of our legacy application and source codes."
DATA POLICY IN NEED OF "SERIOUS REVIEW"
That it violated the PDPA four times since 2018, seemed to indicate Grab was in need of a "serious review", noted Ian Hall, Synopsys Software Integrity Group's Asia-Pacific manager of client services. In particular, the company should assess its release processes, where required testing and checkpoints must be passed before the release of its app.
Click to expand...

Log in or Sign up

Singapore Says Grab’s Fourth Privacy Breach Is Concerning

guest Guest

guest Guest

Log in or Sign up

Singapore Says Grab’s Fourth Privacy Breach Is Concerning

guest Guest

guest Guest

Useful Searches