SPH Media, the Singapore media group behind The Straits Times, said on 10 November 2026 that cyberattacks had hit five of its systems, with email addresses making up most of the data exposed in 9 per cent of its database, alongside some names, mailing addresses and phone numbers. No payment card details, financial or banking information, or customer account access was compromised, and the company's news websites and subscription services were unaffected. SPH Media said the attacks are believed to be a concerted effort by the same threat actor, who has not been identified, and no attack vector has been disclosed by the company so far. The first incident was detected on 4 November 2026 and the most recent on 8 November 2026, two days before the disclosure.
Chronology of the attacks#
The first incident was detected on 4 November 2026 and the most recent on 8 November 2026, with disclosure following on 10 November, two days after the latest detection. In its own statement, SPH Media described the attacks on the five systems as believed to be a concerted effort carried out by the same threat actor, who has not been identified, and no attack vector has been disclosed by the company so far. The five systems fell into two groups, one holding some personal data and the other holding systems that stored no personal data. The data exposure came from the systems in the first group, while SPH Media reported unauthorised access to the systems in the second group with no data exposure attached. The statement did not specify the extent of exposure from the second group, a gap Channel News Asia also noted. No source has reported the exposed data published or sold anywhere, no source has reported misuse of it, and SPH Media has not stated whether the data has been misused, so no misuse has been reported either way.
Exposed personal data#
Email addresses dominated the exposed data, with some names, mailing addresses and phone numbers appearing alongside them, and SPH Media put the total at 9 per cent of its database, a figure The Straits Times also reported. No absolute victim count was disclosed, since SPH Media gave only the proportion affected with no total size for the database, so no headcount can be worked out from the published information and this article gives none. The 9 per cent figure is the only measure of scale available. The Straits Times reported that some email addresses belonging to employees and corporate customers were compromised, while the SPH Media statement itself says nothing about employees or corporate customers, so the two sources differ on this point. An exposed email address on its own gives an attacker no account access, but it does give an attacker a working address to aim phishing at, and that risk grows when real names and addresses travel with it, since real details make fake messages harder to spot. The guide on how phishing uses a leaked email describes how a leaked address is used in phishing attempts.
Data not exposed#
SPH Media stated that no payment card details or financial or banking information was compromised. Customer account access was not compromised either, and The Straits Times reported that subscribers' access to their accounts was not affected. The company's news websites and subscription services were unaffected. The guide on email breaches and password breaches explains why an exposed address and an exposed password are different problems with different fixes.
Suspected AI involvement#
SPH Media said it suspects the intrusions could be AI-enabled attacks, a suspicion that rests on preliminary investigations, and The Straits Times reported both the suspicion and its preliminary basis. Channel News Asia reported that SPH Media is unable to confirm whether the attacks are AI-enabled while investigations are ongoing, so the AI element stays a suspicion, not an established fact. The company put the cause down to a combination of factors, including software bugs and system configuration, with no further detail published, and a company spokesman gave that description to The Straits Times. No specific software or system has been named, and the company said it has applied bug fixes to its information technology systems, updated the system configurations and perimeter defences to block further probing and exploitation attempts, and heightened monitoring.
SPH Media said it is enhancing its defences to better detect AI-aided attacks, with safeguards to identify vulnerabilities earlier and remediate them swiftly forming part of that work. The company said it will continue to keep a close watch on its systems, since cyberattacks can happen at any time and at any frequency. Whether the AI suspicion is confirmed or dropped will depend on the investigation. No evidence for the AI-enabled suspicion has been published.
SPH Media response#
SPH Media said it moved at once to secure the affected systems once the incidents were discovered, and engaged external cybersecurity experts to investigate and contain the breaches. The company is working closely with the relevant authorities, and third-party specialists are involved as well. A company spokesman said SPH Media takes the security and confidentiality of customers' information very seriously. SPH Media said it informed all impacted parties about the incident and advised them about the precautions they should take, with its advisory posted on the company's website main page. The company advised customers to remain vigilant, as set out in the advisory below. The Straits Times reported that employees and corporate customers were among those advised, and they were told to exercise caution and stay vigilant against suspicious and unsolicited messages.
SPH Media advised customers to remain vigilant and exercise caution for suspicious and unsolicited emails, messages and calls, particularly ones requesting personal information, passwords or payments, and to avoid clicking on suspicious links or attachments.
Reports to regulators#
SPH Media reported the incident to the Personal Data Protection Commission (PDPC), the Cyber Security Agency of Singapore (CSA) and the Infocomm Media Development Authority (IMDA). A police report was filed as well. The three agencies issued a joint statement on 10 November 2026 in response to queries, saying they are aware of the incident, and IMDA and PDPC are investigating the incident while CSA monitors developments closely. The agencies said they have asked SPH Media to contain the impact and identify the root cause of the incident, and their joint statement added that organisations should implement measures to protect their systems against data breaches. Members of the public should remain vigilant to potential phishing attempts and scams, the statement added.
Singapore context#
Channel News Asia reported that the incident follows other reported Singapore breaches, including telco M1 and telehealth provider Doctor Anywhere on 6 November. The M1 breach exposed customers' personal information, including names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses. AliasFleet covered it on 7 November 2026. Doctor Anywhere reported a leak of users' personal data. Clinical records were not affected, according to cybersecurity and forensic specialist Ensign InfoSecurity. Channel News Asia also reported that data relating to around 46,000 Singapore Airlines booking records was accessed in a breach involving software provider Amadeus, which affected at least eight airlines.
Precautions for affected readers#
People whose email address was in the exposed portion of the database can check whether the address appears in a known breach. Have I Been Pwned lists breaches by email address. Passwords reused across services should be changed, starting with the accounts that matter most: email, banking and any account that holds payment details. A password that appears only on one service cannot be reused by an attacker elsewhere, which is the point of using a different password per service. The guide on whether changing a password stops hackers covers when a password change helps and when it does not. Two-factor authentication should be turned on wherever it is offered, since it blocks logins that rely on a stolen password alone.
Unexpected emails, messages and calls should be treated as suspicious, particularly ones that request personal information, passwords or payments. SPH Media's own advice is to avoid clicking on suspicious links or attachments, and the company advised customers to remain vigilant against suspicious and unsolicited messages. A message that names the recipient correctly and refers to a real SPH Media subscription is not proof that it comes from SPH Media, because the exposed data included the names and email addresses needed to write such a message. The guide on how to check if an email is phishing sets out the checks that catch most of these messages.
An email address given to SPH Media is the same address that will now receive any phishing built on this breach, so a person who used one address for every service cannot tell which service leaked it when a phishing message arrives. A person who used a separate alias per service can trace a phishing message back to the service whose address it was sent to, and can stop that alias without touching any other service. Email aliases are a managed, persistent identity per service, not a short-lived inbox, and the alias keeps working until the owner pauses or deletes it. SPH Media advised impacted parties to stay vigilant against suspicious emails, messages and calls, and a phishing message sent to a service-specific alias identifies the service behind the leak.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Ongoing investigation#
The investigation is ongoing, and SPH Media has not named the threat actor behind the attacks, disclosed an attack vector, or said whether the exposed data has been misused. The AI-enabled suspicion is preliminary and unconfirmed, and no evidence for it has been published. The regulators have asked SPH Media to contain the impact and identify the root cause, and their investigations continue alongside the company's own work with external experts. Two questions stay open: whether the exposed data appears outside SPH Media's systems, and whether the investigation confirms the AI-enabled suspicion. SPH Media said it will continue to keep a close watch on its systems.
