By 
The Singapore-based luxury resort and casino Marina Bay Sands revealed it was hit by a security incident that exposed the personal data of 665,000 customers.
According to a statement by the resort, the incident was discovered on October 20 and involved unauthorized third-party access on 19 and 20 October 2023 to its non-casino customers’ loyalty program membership data.
The leaked data included personally identifiable information (PII), such as customers’ names, email addresses, phone numbers, country of residence, membership numbers and tiers.
The resort stated that they do not have evidence that the unauthorized third party has misused the data to cause harm to customers.
Data from the casino rewards program, Sands Rewards Club, was allegedly unaffected.
After being aware of the incident, the teams immediately took action to resolve it. The resort has worked with a leading external cybersecurity firm, and have taken action to further strengthen the systems and protect data.
They have reported it to the relevant authorities in Singapore and other countries where applicable and are working with them in their inquiries into the issue.
While the scope of the attack has not been clarified publicly, the intrusion could be related to a ransomware attack. Threat actors are often stealing data from company networks and then try to extort money from the victim. As of now, no ransomware actor has claimed the attack on Marina Bay Sands.
The Marina Bay Sands staff has started individually informing Sands LifeStyle loyalty program members about the incident.
