SPH Media, the Singapore publisher behind The Straits Times, The Business Times and Lianhe Zaobao, said on Tuesday, November 10, 2026, that a series of cyberattacks on 5 of its systems exposed about 9% of its database. The exposed records are mostly email addresses, along with some names, mailing addresses and phone numbers.
The company said no passwords, payment card details, financial or banking information, or customer account access were compromised. Its news sites and subscription services were not affected.
Five days, five systems
According to the company’s statement, reported by The Straits Times, SPH Media detected the first incident on November 4 and the most recent on November 8. It believes the attacks were “a concerted effort that was carried out by the same threat actor.”
The first intrusion involved unauthorized access to 2 portals used by staff and vendors who support subscriber orders, The Business Times reported. Further attacks followed on the days after.
The affected systems fall into 2 groups, all managed in-house by SPH Media:
- Systems that held some personal data, where the exposed records add up to about 9% of the company’s database
- Systems that were accessed without authorization but did not store personal data
Some employee email addresses were also exposed. SPH Media declined to say how many people are affected.
Software bugs and configuration, not phishing
An SPH Media spokesperson said the breaches came from “a combination of factors, including software bugs and system configuration.” The company described the incident as a direct attack on its own systems and said it did not start with phishing, a user clicking a link or a third-party provider.
SPH Media said it has applied bug fixes, updated system configurations, tightened its perimeter defenses to block further probing and exploitation attempts by the attacker, and raised its monitoring posture.
Suspected AI-enabled attacks
Based on preliminary findings, SPH Media suspects the intrusions may have been AI-enabled, meaning the attacker may have used AI tools to find and exploit weaknesses faster than a human team could. The company told CNA that it cannot yet confirm this while investigations continue, and it did not name the threat actor.
SPH Media said it is strengthening its defenses to better detect AI-aided attacks, including safeguards meant to find vulnerabilities earlier and fix them quickly. AI-assisted intrusions have been a recurring theme in recent incidents, including the Vapor Panda ARTEX campaign that used AI agents against more than 200 organizations.
Regulators and police notified
The company reported the incidents to Singapore’s Personal Data Protection Commission, the Cyber Security Agency of Singapore and the Infocomm Media Development Authority, and filed a police report. It has engaged an external digital forensics and incident response firm to investigate and contain the breaches.
SPH Media said it has informed all affected parties. Notification emails to registered users explain which details were exposed, such as an email address, and warn that the information could be used for phishing or scam attempts. SPH Media has also placed a “Stay Alert. Stay Safe.” advisory on its corporate website, reminding subscribers that it will never ask for personal, banking or payment information through unsolicited calls, emails, text messages or messaging apps.
The latest in a run of Singapore breaches
SPH Media’s disclosure follows a string of recent incidents in Singapore. On November 6, telco M1 confirmed a breach exposing customer NRIC numbers and contact details, and telehealth provider Doctor Anywhere confirmed a breach involving bank details and ID numbers. On the same day as SPH Media’s statement, food services company SATS said its school meal ordering app Tappee was breached through a platform vulnerability, affecting students at 4 schools.
No authority has linked these incidents to a single actor.
What SPH Media subscribers should watch for
- Treat unexpected emails, texts or calls that mention your SPH subscription, delivery or billing with caution, even if they use your name and address.
- Do not share passwords, one-time codes or card details in response to unsolicited messages.
- Check any unusual request through SPH Media’s official website or its customer service hotline at 6388 3838.
- Turn on multi-factor authentication for your email and other accounts where available.
