MBS becomes aware of data leak and reports to authorities

Marina Bay Sands said it was first aware of the incident on Oct 20, and investigations showed that members' personal data was accessed by an unknown third party¹. The leak affected the contact details and other personal information of some 665,000 members of Sands LifeStyle, the integrated resort's shoppers' rewards program¹. The operator told The Straits Times the leaked data includes members' names, e-mail addresses, phone numbers, country of residence, and their membership numbers and tiers¹. Credit card numbers were not leaked¹.

In an e-mail to Sands LifeStyle members, MBS chief operating officer Paul Town said the company acted once it found out.

Town said there was no evidence to date that the unauthorized third party had misused the data to cause harm to customers, and that MBS does not believe membership data from its casino rewards program, Sands Rewards Club, was affected¹. MBS has reported the incident to the authorities and is working with an external cyber-security firm, and has taken action to strengthen its systems, he said, without elaborating on the steps taken¹. He urged members to monitor their accounts for suspicious activity, change log-in credentials regularly and be vigilant against phishing attempts¹.

Cyber-security specialists told the paper that leaked data can still be used even without card numbers. Trend Micro Singapore country manager David Ng said fraudsters can use names and e-mail addresses to personalize phishing campaigns or scams, for instance by impersonating big retail names and creating fake websites to trick shoppers into sharing their personal data¹. F5 senior solutions architect Shahnawaz Backer said such data can be used to open unauthorized accounts in victims' names, and cited research showing an individual's personal information can be worth up to US$1,000 (S$1,400) or more on the Dark Web¹.

The report placed the incident alongside earlier Singapore data breaches. In 2020, ShopBack's customer database was breached and put up for sale online, affecting more than 1.4 million customers, and the platform was fined $74,400 by the authorities¹. A data breach in October 2022 at Carousell exposed the personal information of 1.95 million users¹.

What it means for players

The leak covers Sands LifeStyle, the shopping and lifestyle rewards program, not the Sands Rewards Club casino program, which MBS says it does not believe was affected¹. Anyone who holds a Sands LifeStyle membership and supplied a name, e-mail address, phone number, country of residence and membership tier may have had that information accessed¹. No credit card numbers were leaked¹.

The practical risk described by the specialists is not direct theft from a card, but the use of real personal details to make scam messages, calls or fake websites look genuine, and the possible opening of unauthorized accounts in a victim's name¹. MBS has said it has no evidence to date that the data has been misused to cause harm¹. The company has not said how many people in Singapore or elsewhere are affected, and no fine or regulatory penalty has been reported in connection with this incident.

What happens next

MBS has reported the incident to the authorities and is working with an external cyber-security firm¹. It has not said which authorities were notified, what the strengthened systems involve, or whether an investigation is under way. No timeline for further updates has been reported.