RedMart slapped with SG$72,000 for data breach

share on

twitter /
facebook /
linkedin /
- email
- telegram
- whatsapp
- wechat
- pinterest
- line
- snapchat
- reddit

Lazada owned RedMart was slapped with a SG$72,000 fine imposed by Singapore’s privacy watchdog, Singapore’s Personal Data Protection Commission (PDPC). According to PDPC the organisation failed to place security measures to protect personal data in its possession.

The fine comes two years after an incident took place in October 2020 which saw personal information of Redmart users being placed up for sale online. Details put up for sale included names, passwords, phone numbers and partial credit card numbers. According to PDPC, it noted that there was a complexity in the organisation’s network and architecture and that the affected database was behind “various levels of security controls”.

However, “at every level of defence, the organisation’s systems presented clear vulnerabilities that should have been addressed”. The PDPC also said there is “no one size fits all” approach when it comes to protecting personal data.

“Each organisation should consider adopting security arrangements that are reasonable and appropriate in the circumstances,” it added. Given the high volume of personal data contained in the affected database, PDPC said that it was incumbent on the organisation to implement policies and practices that were commensurate with higher-level security needs to discharge its obligation under the Protection Obligation.

The integration of Lazada anad RedMart first took place on 15 March 2019, as part of its efforts to ramp up its supermarket business in Southeast Asia. The partnership was to accelerate Lazada’s growth to become the region’s “biggest eCommerce ecosystem”. RedMart was acquired by Lazada in 2016, but operated on separate platforms. With the move, shoppers were able to buy groceries and fresh produce along with Lazada’s other product categories on one single platform.

share on