Incident BriefingsMoneySmart internal-systems data incident

MoneySmart internal-systems data incident

MoneySmart discovered unauthorized access to internal IT systems on October 29, 2026.

Last modified

Summary

  • Environment: MoneySmart internal IT systems
  • Operational impact: Some Singapore and Hong Kong customer data copied
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 3, 2026; updated as evidence emerges.

What happened

MoneySmart discovered unauthorized access to internal IT systems on October 29, 2026. [1]

Impact

Its investigation confirmed personal data belonging to some customers in Singapore and Hong Kong was copied. The public statement does not quantify the population or specify data fields. [1]

MoneySmart said it continued operating normally. [1]

Timeline

  1. Unauthorized access discovered

    Unauthorized access discovered, as described in the company notice.

    [1]

  2. Public notice and customer emails

    Public notice and customer emails, as described in the company notice.

    [1]

  3. Briefing updated

    This briefing was last reviewed and updated on November 3, 2026.

Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

MoneySmart stopped unauthorized access, secured systems, notified authorities, hired independent forensic experts and began contacting affected customers directly. [1]

MoneySmart warned about unexpected communications and said it would never request passwords, one-time passwords or banking details by phone or email. [1]