Cyber Incident Victim: Foodpanda Singapore
Date:
Jul 2019
Location:
Singapore
Summary
Foodpanda Singapore experienced a cybersecurity breach where its Instagram account was compromised, leading to abusive messages being sent to customers. A user reported receiving threatening and vulgar responses after posting a service complaint, including demands to delete her post and personal insults. The company confirmed the account hack, advised customers to cease engagement with the platform, and initiated efforts to resolve the issue. The incident involved unprofessional interactions during a customer's order cancellation attempt, with discrepancies in order timing noted. The breach caused reputational harm and disrupted customer communications, though restoration progress was not detailed.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In mid-July 2019, Foodpanda Singapore's verified Instagram account was compromised by unauthorized actors, leading to abusive interactions with customers. The incident became publicly visible when customer Jenny Liang shared her experience on July 14 after receiving hostile direct messages from the compromised account. Liang had initially posted a critical review of her Foodpanda experience on Instagram, tagging the company's official account. Within minutes, she received a message stating "Delete this, you dumb w*****," which disappeared after being read. When Liang subsequently posted screenshots documenting this interaction, the hacked account responded with additional vulgar messages including "F*** you, b****" and "Suck my d***." Separately, Liang reported order fulfillment discrepancies where live chat support claimed her meal was being prepared at 7:45 PM, while delivery documentation indicated the order had been collected at 7:13 PM, though no direct connection between this service issue and the cybersecurity incident was established.
Foodpanda Singapore officially acknowledged the breach through a Facebook post on July 15, confirming their Instagram account had been hacked and advising customers to cease engagement with the compromised platform. The company stated its cybersecurity team was actively working to regain control and resolve the issue, though specific technical details about the intrusion method or duration of unauthorized access were not disclosed. Public evidence showed the account remained visibly altered following the announcement. The incident caused reputational damage through the dissemination of offensive messages to customers, with Liang's viral posts amplifying public awareness. No information was provided regarding whether the hackers accessed customer data beyond sending abusive messages, nor were details disclosed about the eventual account restoration process or whether law enforcement was involved in the investigation.