Cyber Incident Victim: Toppan Next Tech
Date:
Apr 2025
Location:
Singapore
Summary
A ransomware attack onToppan Next Tech, a printing vendor for DBS, led to the potential exposure of personal data belonging to thousands of DBS and Bank of China customers. The compromised information includes names, addresses, details of equities held through DBS Vickers and Cashline loans, and, for Bank of China customers, loan account numbers, while login credentials, passwords, NRIC numbers, and financial balances were not exposed. DBS and Bank of China have confirmed that their internal systems were not breached, are monitoring affected accounts, and are notifying impacted customers as investigations continue with support from the Monetary Authority of Singapore and the Cyber Security Agency of Singapore.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April1 2025 a ransomware attack was reported against Toppan Next Tech the vendor contracted by DBS to print customer statements. DBS disclosed that approximately 8 200 of its customers’ data were potentially compromised as a result of the incident. Bank of China’s Singapore branch separately indicated that about 3 000 of its customers were similarly affected. The affected customers primarily hold brokerage accounts with DBS Vickers or use Cashline services.
DBS stated that its own systems were not compromised and that customer deposits and monies remained safe with no evidence of unauthorized transactions. The potentially compromised statements were those printed for individual customers dated December 2024 January 2025 and February 2025 and were transmitted to Toppan Next Tech in encrypted files. DBS noted that it is unknown whether the threat actor succeeded in decrypting those files. The data that could have been exposed includes names postal addresses and details of equities held under DBS Vickers and Cashline loans but does not include login credentials passwords NRIC numbers deposit balances or total wealth holdings.
In response DBS halted all printing jobs with Toppan Next Tech increased surveillance for unusual activity on the potentially impacted accounts and began notifying affected customers by email where available and by physical mail otherwise. Bank of China reported that the exposed data consisted of customer names addresses and in some cases loan account numbers with no transaction banking information or login credentials affected. The Monetary Authority of Singapore and the Cyber Security Agency of Singapore confirmed that the attack was reported on April 6 and that CSA is assisting Toppan Next Tech with investigations while MAS is engaging with the banks on risk‑mitigating measures and enhanced monitoring of the relevant accounts.