ShopeePay fined 25 million VND for lack of information security

The Inspectorate of the Ministry of Information and Communications has just issued a decision to administratively fine ShopeePay Joint Stock Company VND 25 million. Previously, on August 19, 2024, in order to assess ShopeePay's compliance with the law on network information security, the Department of Information Security (Ministry of Information and Communications) conducted an inspection of the company.

The audit results showed that ShopeePay has not yet implemented an assessment of the effectiveness of management and technical measures applied to the enterprise's information system as prescribed.

Specifically, the company has not checked the completeness and suitability of the Information Security Regulations according to the approved information security plan; has not assessed compliance with the regulations and procedures in the Information Security Regulations during the operation, exploitation, termination or cancellation of the information system; the design of the information system, the establishment and configuration of the information system according to the approved information security plan.

Basically, ShopeePay complies with the law on network information security, implementing a number of contents such as: Issuing and updating policies and regulations on ensuring network information security; developing and implementing a network information security plan; allocating funds for incident response, ensuring network information security; processing personal information of service users according to regulations; implementing monitoring, taking measures to prevent and combat malware to protect the information system...

The Ministry of Information and Communications recommends that when investing in equipment and solutions for information systems, organizations and businesses need to pay attention to equipment configuration, apply optimal technical solutions suitable for their information systems, and at the same time need to strengthen inspection and evaluation of the effectiveness of network information security measures according to approved plans to enhance the effectiveness of ensuring network information security of the system.