Lenskart discloses cyber incident at Singapore group company sub-vendor
Lenskart said a cyber incident at a sub-vendor of its Singapore-based group company was identified and remediated. Singapore’s data privacy regulator has been notified; the company said its operations, group entity and customers were not disrupted.
What happened
Lenskart disclosed a cyber incident at a sub-vendor of its Singapore-based group company. The issue was identified and remediated, with Singapore’s data privacy
Why this matters
For partners or acquirers, the incident reinforces cyber due diligence around vendor dependencies, data-handling obligations, and regulatory notification readiness across cross-border group structures.
What to watch
- Singapore PDPC investigation, information request, enforcement notice or public decision.
- Any revision to Lenskart's statement that customers, operations or group entities were unaffected.
- Evidence that prescription, contact, payment, identity or employee data was involved.
- Customer notification activity, phishing reports, account-security alerts or unusual support volumes.
- New cybersecurity, legal or compliance provisions disclosed in financial updates.
- Broader review of Singapore-based data-processing arrangements or other third-party vendors.
- Complete forensic investigation and document whether any personal data was accessed, exfiltrated or retained by the sub-vendor.
- Notify affected parties if required and provide a clearer scope-of-impact update to investors, customers and regulators.
- Review all group-company vendors handling customer, employee, prescription, payment or identity data.
- Tighten vendor contracts around breach notification, data minimization, audit rights, encryption and cross-border data handling.
- Increase board-level cyber-risk reporting ahead of any IPO, fundraising or international expansion activity.