Data leak exposes data of 665,000 MBS rewards members

Marina Bay Sands (MBS) has told about 665,000 members of its Sands LifeStyle shoppers' rewards program that their personal data was exposed in a leak between Oct 19 and 20, 2023¹. The Singapore integrated resort operator said it was first aware of the incident on Oct 20, and that an unknown third party accessed the data¹.

In an e-mail to members on Nov 7, 2023, MBS chief operating officer Paul Town said the company had reported the incident to the authorities and was working with an external cyber-security firm¹. The data leaked includes members' names, e-mail addresses, phone numbers, country of residence, and their membership numbers and tiers¹. Credit card numbers were not leaked¹.

MBS did not elaborate on the steps it took to strengthen its systems¹. It urged members to monitor their accounts for suspicious activity, change log-in credentials regularly and be vigilant against phishing attempts¹.

Security specialists quoted by The Straits Times said the leaked details can still be used for fraud even without card numbers. David Ng of Trend Micro Singapore said fraudsters can use names and e-mail addresses to personalize phishing campaigns or create fake retail sites¹. Shahnawaz Backer of F5 said such data can be used to open unauthorized accounts in victims' names, and that an individual's personal information can be worth up to US$1,000 (S$1,400) or more on the Dark Web¹.

The report places the incident alongside earlier Singapore breaches. In 2020, ShopBack's customer database was breached and put up for sale online, affecting more than 1.4 million customers; the platform was fined $74,400¹. A data breach in October 2022 at Carousell exposed the personal information of 1.95 million users¹.

What it means for players

The leak covers Sands LifeStyle, the non-casino rewards program, not the Sands Rewards Club casino program, according to MBS¹. Members of the casino program are told their membership data is not believed to have been affected¹.

For anyone who holds a Sands LifeStyle account, the exposed fields are contact and membership details rather than payment cards¹. That still gives a scammer enough to address a message to a real member by name, quote a real membership tier and pose as the operator, which is the pattern the specialists describe¹. People who gamble at Marina Bay Sands and also shop or stay there may hold both accounts, so a message that looks like it comes from the resort is not by itself proof that it does. General guidance on spotting fake sites and reporting scams in the region is set out in our guide to gambling scams and safety in Asia.

What happens next

MBS says it has reported the incident to the authorities and engaged an external cyber-security firm, and that it has taken action to strengthen its systems¹. No further detail on those measures was given¹. No regulator response, investigation outcome or penalty has been reported¹.