A data breach at the Singapore mobile operator Simba has affected 23,549 customers, according to a report from Malay Mail published on 28 September.
The report says
the Personal Data Protection Commission is investigating the incident, and affected customers are being notified by email.
The report also says the notifications were expected to be completed by a set date.
What is confirmed, and what is not
The source material I could access is limited. It gives the number of affected customers, the regulator’s investigation and the notification by email. I could not confirm from it which types of personal data were exposed, how the intruders got in, or whether any data has been published or sold.
Those details matter. A leaked name and email address carries a different risk from leaked identity numbers, addresses or billing details. Readers who are Simba customers should wait for the company’s own notice, and should read it closely when it arrives.
If you are a Simba customer
- Check your inbox and spam folder for a message from Simba. Do not click links in it. Go to the company’s website or app by typing the address yourself.
- Treat unexpected calls and texts with suspicion. After a telecoms breach, scammers often pose as the telco, a bank or an official body and use real customer details to sound credible.
- Never share one-time passcodes. No genuine company will ask you to read one out over the phone or by message.
- Change your account password and do not reuse it elsewhere. Turn on two-step verification where it is offered.
- Watch your bank and card statements for charges you do not recognise, and report them to your bank quickly.
Why telecom breaches draw scrutiny
Mobile numbers are tied to many other accounts. They receive login codes and password-reset messages, so a phone number combined with personal details gives fraudsters a starting point for impersonation. That is why regulators look closely at how telcos protect customer records.
The PDPC’s investigation will examine how the incident happened and whether the company met its obligations. The report does not say when the inquiry might conclude, and no outcome has been announced.
What to watch for next
Customers should expect more detail from Simba on the type of data involved. If the company’s notice is vague, it is reasonable to ask it directly what was taken. Keep a copy of the email in case you need to show it to your bank or the authorities.
This article will be only as complete as the public record. As of the source report, the scale of the breach is known, but its cause and the exact data exposed are not.