Get the latest tech news

Carousell fined S$58,000 over data leaks that affected more than 2.6 million users

One such leak, which happened during a system migration process, led to Carousell customers' data being offered for sale on an online forum.

Due to human error, however, the email addresses and names of guest users were automatically appended to all messages sent to the listing owners of all categories in all markets. While names associated with users’ accounts were also disclosed, the PDPC did not consider this relevant in assessing how Carousell breached the Personal Data Protection Act (PDPA). When the company conducted internal investigations to find out if users’ personal data had been accessed without authorisation in the 60 days before it discovered the bug, it did not detect any anomalies.

Get the Android app