RedDoorz data breach

In September 2020, Singapore-headquartered hospitality start-up RedDoorz suffered a breach that exposed roughly 5.9 million customer records — at the time the largest data breach since Singapore's Personal Data Protection Act (PDPA) came into force in 2014. The breach stemmed not from a sophisticated attack but from a cloud-credential left embedded in an old mobile app.

What happened

RedDoorz, operated by Commeasure Pte Ltd, runs a budget-hotel booking platform across Southeast Asia. On 19 September 2020, an American cybersecurity firm alerted the company that one of its databases had been accessed without authorisation. Commeasure notified the Personal Data Protection Commission (PDPC) on 25 September.

Investigators traced the exposure to an access key embedded in an outdated, unused Android APK still publicly available. The key granted access to a database hosted on Amazon Web Services, allowing an attacker to query and exfiltrate the full customer dataset. The PDPC found that Commeasure had no process to manage or remove credentials in legacy code and had not detected the exposure itself.

Impact

• About 5.9 million customer records were exposed, including names, contact numbers, email addresses, dates of birth, encrypted passwords and booking information.
• Masked credit-card numbers were present but the full card numbers and CVVs were not compromised, limiting direct financial fraud.
• Only around 9,000 affected customers were Singaporeans, but the breach fell under the PDPA because Commeasure is Singapore-based.

Penalty

On 15 November 2021, the PDPC fined Commeasure S$74,000 (about US$54,000). Although this was the largest breach by volume to date, the fine was comparatively modest — the Commission explicitly cited the financial hardship the COVID-19 pandemic had inflicted on the hospitality sector as a mitigating factor in setting the penalty.

Why it matters

The RedDoorz case became a textbook example of cloud-misconfiguration and secrets-management failure. The root cause — a hard-coded credential shipped in a mobile app and never rotated or revoked — is among the most common and preventable cloud-security mistakes. The PDPC's decision underscored that organisations are responsible for the full lifecycle of access credentials, including those buried in deprecated code, and that protective-obligation breaches can be enforced even when most affected individuals are overseas. It remains a frequently cited Singapore enforcement precedent for startups scaling on cloud infrastructure faster than their security practices.