Singapore media group SPH Media has confirmed that a series of cyberattacks on five of its internal systems exposed personal information from about nine per cent of its database. The company disclosed the incidents on 10 November 2026, saying the attacks are believed to be a coordinated effort by the same threat actor.

The first incident was detected on 4 November, and the most recent was identified on 8 November. SPH Media said the attacks affected two groups of systems. One group held some personal data, while the other stored no personal information at all.

What information was exposed

For the systems that held personal data, the exposed information was predominantly email addresses, along with some names, mailing addresses and phone numbers. Together, the affected records amounted to nine per cent of the company's database. SPH Media has not disclosed how many individuals were involved.

The company stressed that no payment card details, financial or banking information, or customer account access was compromised. Some employee email addresses were also caught up in the incident, but the company's news websites and subscription services were unaffected.

SPH Media said the breaches resulted from a combination of software bugs and system configuration issues. Based on preliminary investigations, the company suspects the intrusions could have been AI-enabled attacks, although that has not been confirmed and the attackers have not been identified.

How SPH Media responded

As soon as the incidents were discovered, SPH Media said it secured the affected systems and brought in external cybersecurity experts to investigate and contain the breaches. The company reported the incidents to Singapore's Personal Data Protection Commission, the Cyber Security Agency of Singapore and the Infocomm Media Development Authority, and filed a police report.

All impacted parties have been informed about the incident and advised on the precautions they should take, the company said. Its advisory is also posted on its website's main page. Customers who received a notification have been told that their email address was exposed, but that no passwords, payment card details, financial or banking information, or customer account access was compromised.

What customers should watch for

SPH Media has advised customers to remain vigilant and to exercise caution over suspicious and unsolicited emails, messages and calls, particularly those requesting personal information, passwords or payments, and to avoid clicking on suspicious links or attachments. Although the exposed data did not include financial details or passwords, email addresses can still be used for phishing or scam attempts.

The company said it takes the security and confidentiality of customers' information very seriously and has been working closely with the relevant authorities and third-party specialists. It added that it remains committed to safeguarding the information entrusted to it.

The investigation is continuing, and SPH Media has not said when it will be completed or whether further details about how the attackers gained access will be published.