SPH Media, Publisher of The Straits Times, Says One Attacker Possibly Using AI Hit Five Systems in Five Days

The company behind Singapore's main newspapers spent last week fending off the same intruder again and again. SPH Media, which publishes The Straits Times, The Business Times and Lianhe Zaobao, said on Tuesday that attacks on five of its systems exposed about 9% of its database, and that it believes a single threat actor, possibly using AI, was behind all of them.

The first intrusion was detected on November 4 and the last on November 8. The exposed records are mostly email addresses, plus some names, mailing addresses and phone numbers. SPH Media says no payment cards, banking details or customer accounts were compromised, and its news sites and subscriptions kept running. It has not said how many people are affected.

Bugs, settings and a direct attack

The first break-ins hit two portals used by staff and vendors who handle subscriber orders. The company says this was a direct attack on its own systems, not phishing, not a clicked link and not a breach at a supplier. A mix of software bugs and system configuration let the attacker in.

Two groups of in-house systems were hit. One held personal data. The other did not, but was still accessed without authorization. Some employee email addresses were exposed too. No corporate customers' data was affected.

The AI part

SPH Media's suspicion of AI comes from preliminary investigations, and it has not explained what points that way or named the attacker. What it has described is persistence: one actor, five systems, a new intrusion on several days of a single week, and enough probing that the company had to change its perimeter defenses to stop it. Researchers are already using AI to comb apps for secrets, as in the recent Wyndham app password case, and attackers have the same tools.

The company has applied bug fixes, changed its configurations, tightened its perimeter to block more probing, and brought in an outside incident response firm. It reported the attacks to Singapore's Personal Data Protection Commission, the Cyber Security Agency and the media regulator IMDA, and filed a police report. It says it is also building defenses aimed at AI-aided attacks, meant to find and fix holes sooner.

For readers whose email sits in that 9%, the practical risk is phishing: messages that look like they come from a newspaper they already pay for.

Some offers on this page may be paid placements or contain affiliate links.