Marina Bay Sands fined $315k over 2023 data breach involving more than 600,000 visitors

Marina Bay Sands (MBS) has been hit with a $315,000 fine by the Personal Data Protection Commission (PDPC), two years after a data breach leaked the personal information of more than 600,000 visitors.

- Sarah Koh

The fine is the second-highest amount meted out by PDPC, after the $750,000 fine on Integrated Health Information Systems (IHiS) for lapses in securing patient data that resulted in the nation’s worst data breach in 2018.

Since October 2022, the maximum penalty that a company with an annual turnover of more than $10 million in Singapore can face for a data breach is 10 per cent of its turnover, or $1 million.

Previously, organisations that violated the Personal Data Protection Act (PDPA) would face a financial penalty of up to $1 million.

"Under the revised financial penalty framework, the penalty (on MBS) accounted for the scale of the data breach which exposed the personal data of more than half a million patrons without their consent," said the commission on Oct 28, adding that the casino and hotel operator had admitted to breaching the protection obligation under the PDPA.