In a string of similar data breaches in the tech-savvy island of Singapore, 30,000 people are now vulnerable to cybercriminals.

Yet another major data breach linked to third-party vendors has occurred. The personal data of at least 30,000 people who are registered with Singapore’s Employment and Employability Institute (e2i) is now in the hands of cybercriminals.

The institute, which is part of the country’s labor union (National Trades Union Congress), is a training and career counseling center. The data that was compromised include names, identity card details, contact and employment details, and educational qualifications.

A spokesperson said that e2i was alerted to a data breach incident on 12 Mar in which an employee at a third-party vendor, i-vic International, had fallen prey to email malware.

People who had used the institute’s services between November 2019 and March 2021, including those who had registered for job fairs, workshop or career coaching. The matter had been reported to the country’s data protection watchdog and also the Cyber Security Agency of Singapore. The third-party vendor filed a report on 22 Mar. Official investigations are ongoing.

The delay in publicizing the breach was attributed to the “complexity of the investigations”, according to the institute.

One expert’s reaction to this breach is that “too many breaches have been happening via the weak cyber vigilance of organizations’ third-party vendors or stakeholders. An organization’s defenses are only as strong as this weakest link.”

Another expert, Evan Dumas, the regional director of Check Point Software Technologies (South-east Asia), commented: “Malware attacks like this one are usually sent as an attachment to an email, and can range from a seemingly innocent resume file sent to HR to an invoice file sent to accounts payable. The goal is to infect the end-user’s machine and gain control over it and the data on it, and in many cases move across the network to infect other machines within the same organization.”

Watch out for further details as the investigations and expert opinions unfold.