One of Singapore’s major travel agents is being probed after customers’ personal data was found to be unprotected online.
Singapore’s Personal Data Protection Commission said it is investigating a data security flaw on Chan Brothers Travel’s website.
Email addresses, phone numbers and NRIC numbers of up to 450 clients were accessible when the co-founder of a local fintech startup was ‘scraping’ publically available data from the site such as customer reviews.
The Chan Brothers Travel Club webpage was ‘not properly configured’ Andrew Goh told Channel News Asia.
The news outlet was also able to access the customer information.
The agency has acknowledged the data security flaw and taken steps to fix it.
"We immediately took action to address the matter including containing the extent of vulnerabilities, assessing the extent of impact and reporting the incident to PDPC," Chan Brothers’ head of marketing communications Jane Chang told CNA.
"We would like to assure our customers that no sensitive booking and financial information was revealed. That said, we recognise that no personal data should be exposed at all, in any manner and that it is our responsibility and priority to protect our customers’ personal data, Ms Chang said.
