Data breach and ISO 27001: two emails in one day

ISO 27001 controls for a data breach cover staff awareness, authentication, access, suppliers and incident records. Your risk assessment under clause 6.1 decides which Annex A controls apply, and the Statement of Applicability records the decision and reason. On 12 October 2026, two data breach emails reached the same inbox.

Talk to a consultant

Two data breach emails arrived on the same day

A large online retailer wrote that an unauthorised party accessed an employee account after impersonating a trusted contact to get log-in details. Its email said the details gave access to certain third-party platforms, and that names, contact details and some non-personal account information, but not payment card details or account passwords, were accessed. The retailer locked down affected platforms, brought in internal and external cyber experts, is working with law enforcement and regulators. Its investigation was ongoing when it wrote.

A Singapore parenting community platform wrote that it identified a cybersecurity incident involving unauthorised access. Its email said it contained the access, secured the affected environment, addressed identified vulnerabilities, engaged external cybersecurity specialists, and informed the Personal Data Protection Commission (PDPC) and the Cyber Security Agency of Singapore (CSA).

Both emails describe actions taken after unauthorised access. A 10-person Singapore company with customer data on online platforms can face similar questions.

The first email described one impersonation

The retailer's email said impersonation obtained log-in details. No hacking tools were named. A call or message can be enough when someone gives away a password or code.

CSA's Incident Response Checklist lists human lapses and authorised third parties as common attack vectors.

CSA advisory AD-2024-020, dated 22 November 2024, covers fake log-in pages that pass your password and multi-factor authentication (MFA) code to an attacker, and repeated approval prompts. MFA is a second check after the password, such as a code, security key or passkey.

CSA recommends phishing-resistant MFA, such as FIDO2 security keys and passkeys, over codes sent by SMS or email, plus staff training on social engineering.

The control records follow the access path

The table maps email events to controls and audit records in an information security management system (ISMS).

At Stage 2, the certification body's auditor samples records to check controls work in practice. The risk assessment under clause 6.1 Actions to address risks and opportunities decides which apply, recorded in the Statement of Applicability.

Annex A controls are a reference, not a checklist every company must apply.

If a buyer has sent a security questionnaire, send it with the systems and cloud platforms in scope, headcount and target date. We map the information to an initial ISMS scope and the records to review, then reply within one working day.

Your brand is on the breach email

A breach email carries your business name, and your customers' trust is what is at stake. The retailer told customers it never asks for passwords, security codes or payment details through an unsolicited message or call. The PDPC's Guide on Managing and Notifying Data Breaches under the PDPA, revised 15 March 2021, says notification can help people protect themselves by changing passwords or watching for possible scams.

The PDPC publishes decisions on PDPA investigations and voluntary undertakings. Its Guide on Active Enforcement, revised 1 October 2022, says that under section 48J, the PDPC may impose a financial penalty of up to S$1 million, or 10% of annual turnover in Singapore where that turnover exceeds S$10 million, whichever is higher.

Some customers and tenders ask for ISO/IEC 27001 or a CSA mark. Our comparison of ISO 27001 and the CSA Cyber Trust mark explains the difference. Weak controls can cost a contract when a buyer asks for evidence. An ISO/IEC 27001 certification audit samples the risk assessment, Statement of Applicability and records for the controls your business applies. ISO/IEC 27001 reduces risk, but it does not make a company breach-proof.

Send any customer requirement or security questionnaire with systems and cloud platforms in scope, headcount and target date. We identify the requested security assurance and ISMS records, then reply within one working day.

The PDPA sets the clock after a breach in Singapore

The platform's email said it informed the PDPC and CSA. Once a company has credible grounds to believe a breach occurred, the PDPC's breach guide requires reasonable and expeditious steps to assess whether it is notifiable within 30 calendar days, with those steps documented.

A breach likely to cause significant harm to affected people must be notified to the PDPC and those people. A breach affecting 500 or more people must be notified to the PDPC, even if no prescribed personal data is involved. Notify the PDPC as soon as practicable, no later than 3 calendar days after deciding the breach is notifiable. PDPC's example: a decision on 1 January means notifying by 4 January. Where required, affected people are told at the same time or after.

SingCERT, CSA's cyber-incident reporting service, accepts reports from people and organisations based in Singapore, including phishing, ransomware and unauthorised access attempts. Report through the SingCERT incident reporting form or singcert@csa.gov.sg (Cyber Aid page, updated 4 May 2026). Use the PDPC guide or your company's legal adviser as the reference for your own case.

Seven questions show where one log-in could reach

In the retailer's case, one log-in reached third-party platforms. Each question maps to an Annex A control.

1. Trusted contact requests

   Would staff check a "trusted contact" request through a known number? (6.3, 5.14)

2. Log-in protection

   Does every cloud platform log-in need more than a password? (5.17, 8.5)

3. Customer data exports

   Who can export your full customer list? (5.15, 5.18)

4. Admin rights

   Who holds admin rights, and when were they last reviewed? (8.2)

5. Cloud platform list

   Do you have a list of every cloud platform holding customer data? (5.19, 5.23)

6. Unusual activity

   Would you see an unusual log-in or a bulk export? (8.15, 8.16)

7. PDPA decision

   Who decides if a breach is notifiable, and who notifies the PDPC within 3 calendar days? (5.24 to 5.26)

Small-company controls can start this week

1. MFA on key accounts

   Turn on MFA for email, admin and cloud accounts. Use security keys or passkeys for admin accounts, not SMS codes. This supports 8.5 Secure authentication.

2. An incident plan

   Write a one-page plan that names one person to lead, with contacts for your IT vendor, the PDPC, SingCERT, the police and key customers. This supports 5.24 Information security incident management planning and preparation.

3. A staff briefing

   Hold a 15-minute briefing on impersonation and reporting. This supports 6.3 Information security awareness, education and training.

4. PDPA timings

   Write the 30-day assessment limit and the 3-day PDPC notification limit into the plan.

CSA advisory AD-2025-013, dated 29 May 2025, gives the same advice for cloud software: MFA, job-based access, account reviews and audit logs.

Send the cloud and supplier list with any customer requirement or security questionnaire, headcount and target date. We use it to set the initial ISMS scope and identify the access, supplier and incident records to review, then reply within one working day.

Scope and records prepare the certification audit

We define the ISMS scope around the systems and cloud services that hold information in scope. The risk assessment under clause 6.1 Actions to address risks and opportunities decides which controls apply. The Statement of Applicability records each Annex A control as applied or not applied, with the reason.

We prepare an access list for each system, a supplier and cloud-service list, incident contacts and incident logs. Our ISO awareness training records dates and attendees, and covers impersonation and suspicious-request reporting. The ISO gap assessment checks the systems and cloud services in scope, the clause 6.1 risk assessment, Statement of Applicability, and available access, supplier and incident records.

We prepare the internal audit, management review and records as preparation for the certification body's Stage 1 and Stage 2 audits. Its auditor samples records to test how controls operate in practice.

ZES does not certify. Accredited certification bodies do. We do not run incident response, penetration testing or IT security operations. Your IT provider or a specialist handles those.

For a typical SME, plan around 3 to 6 months from gap analysis to the certification audit. Nachi completed the ISO/IEC 27001:2022 Lead Auditor course (Exemplar Global-certified, 2026).

ISO/IEC 27001 is an EDGE Standards activity, up to 50% for SMEs and up to 30% for non-SMEs, if approved. Apply before work or payment. Our ISO 27001 certification cost and EDGE guide explains the cost and EDGE points.

Our ISO/IEC 27001 service sets out the preparation work. Send us any customer requirement or security questionnaire, systems and cloud platforms in scope, headcount and target date. We outline the ISMS scope and records to review, reply within one working day, then arrange a short call or site visit and provide a written quote.

Common questions

Sources

• PDPC, Guide on Managing and Notifying Data Breaches under the PDPA, revised 15 March 2021
• PDPC, Guide on Active Enforcement, revised 1 October 2022
• CSA, advisory AD-2024-020, 22 November 2024
• CSA, advisory AD-2025-013, 29 May 2025
• CSA, SingCERT Cyber Aid, updated 4 May 2026
• CSA, Incident Response Checklist, 23 April 2021
• CSA, cross-mapping between Cyber Trust (2025) and ISO/IEC 27001:2022, 15 April 2025

About the author

Nachi Leong

Principal Consultant, ZES Consulting · PSCMC, TÜV SÜD

One consultant. From start to finish. The consultant you meet is the consultant who stays with your project.

About Nachi