PDPC Official Holding Statement

CORPORATE

26 Oct 2026

COURTS refers to the decision of the Personal Data Protection Commission (PDPC) to impose a financial penalty of $178,000 on the Company.

COURTS accepts the PDPC’s decision and takes its responsibility for data protection very seriously. The Company has since taken steps to strengthen its data security protection measures and practices since the cybersecurity incident (ransomware attack) which occurred on 26 September 2022.

Upon becoming aware of the incident, the Company has taken a number of precautionary measures to contain and remediate the incident including but not limited to: (i) engaging cybersecurity specialists to conduct forensic reports into the cause and extent of the incident; (ii) undertaking a comprehensive data review exercise with the assistance of an external eDiscovery vendor; and (iii) engaging a threat intelligence firm to monitor the dark web and Internet.

While there has been no evidence that the affected data has been exfiltrated or disclosed publicly, COURTS would like to express our sincere apologies for the incident. The Company regrets the inconvenience caused to affected customers and staff (including former employees) and would like to thank them for their patience and understanding. COURTS has set up a dedicated channel to provide support and assistance to any affected individuals at corpcomms@courts.com.sg.

COURTS is deeply committed to protecting the personal information and privacy of all our customers and employees, and we adhere to and comply with the applicable personal data laws and regulations.

Frequently Asked Questions

1. What happened?

COURTS was the subject of a cybersecurity incident (ransomware attack) which occurred on 26 September 2022. The incident resulted in the temporary unavailability of COURTS’ operating system, which was promptly restored with the help of external cybersecurity experts.
Upon becoming aware of the incident, the Company has taken a number of precautionary measures to contain and remediate the incident including but not limited to: (i) engaging cybersecurity specialists to conduct forensic reports into the cause and extent of the incident; (ii) undertaking a comprehensive data review exercise with the assistance of an external eDiscovery vendor; and (iii) engaging a threat intelligence firm to monitor the dark web and Internet.
There has been no evidence that the affected data has been exfiltrated/downloaded, disclosed or leaked publicly by the unauthorised third party.

2. What kind of data was affected?

While there has been no evidence that the affected data has been exfiltrated/downloaded, disclosed or leaked publicly, COURTS would like to extend our sincere apology to the affected individuals.
The Company has since taken steps to strengthen its data security protection measures and practices and has also been working closely with external cybersecurity specialists to ensure that appropriate safety measures are in place.

3. What steps are you taking?

COURTS has taken a number of precautionary measures to contain and remediate the incident including but not limited to: (i) engaging cybersecurity specialists to conduct forensic reports into the cause and extent of the incident; (ii) undertaking a comprehensive data review exercise with the assistance of an external eDiscovery vendor; and (iii) engaging a threat intelligence firm to monitor the dark web and Internet.
We have conducted a rigorous review of our IT systems to ensure that the data we are entrusted with is secure.
We have also implemented additional technical security measures and enhanced our existing policies and procedures to prevent similar incidents in the future.

4. What should I do as a customer?

We encourage you to remain vigilant against incidents of identity theft and fraud and to review your bank account statements and to monitor your other financial records for any discrepancies or unusual activity.

5. Is my data safe? How do I know your systems are secure now?

Since the incident, there has been no evidence that the affected data has been exfiltrated/downloaded, disclosed/shared or leaked publicly.
We have conducted a rigorous review of our IT systems to ensure that the data we are entrusted with is secure.
We have also implemented additional technical security measures and enhanced our existing policies and procedures to prevent similar incidents in the future.

6. Who can I contact for more information?