Post-9.9 Access Review: The Security Clean-Up Singapore SMEs Owe Themselves This Week

What should a Singapore SME do about security in the week after a big online sale? Pull a complete list of every account, integration key, device and exported file that gained access to your systems during the sale — and revoke everything that was temporary. Do it within seven days, while you still remember why each one was created. That's the whole job. It is not a penetration test, not a vendor engagement, and not something to defer until October. A sale like 9.9 doesn't only move inventory; it quietly widens the number of doors into your business, and almost nobody closes them afterwards.

What actually changed in your systems during 9.9?

More than you think. Under order-spike pressure, access decisions get made in minutes and never revisited. In a typical Singapore SME running a marketplace-plus-own-store setup, the sale week creates:

• Temporary staff logins — part-timers, a relative helping with packing, an intern given the admin panel because the ops lead was on a delivery run.
• Shared credentials — the Shopee or Lazada seller password pasted into a WhatsApp group so two people could work the queue simultaneously.
• New device links — WhatsApp Business linked to a second phone or laptop, courier portals opened on a personal machine at home.
• Integration keys — an API token generated at 1am to make a stock sync work, with permissions set wide because narrowing them would have taken another hour.
• Exported customer data — order CSVs pulled for packing lists, remarketing or reconciliation, now sitting in a Downloads folder, a personal Google Drive, or a WhatsApp chat.
• Elevated permissions — someone given the ability to create discount codes or issue refunds, because on 9 September they needed to, once.

Each of these was rational at the time. The failure isn't in granting them; it's in the fact that nothing in the business ever takes them back.

Why does the week after a sale matter more than the week before?

Because attackers aren't interested in you on your busiest day — they're interested in your leftovers. A credential that stops being watched is far more valuable than one being actively used. After the sale, nobody is monitoring the seller account hourly, nobody notices an odd login at 3am, and nobody questions a small refund or a payout bank-detail change.

There's also a compounding problem: 10.10 and 11.11 are coming. Every uncleaned account from 9.9 becomes a pre-existing hole during the next spike, when your attention is even thinner. Peak seasons stack their access debt the same way they stack their inventory debt.

And there's a legal edge. Under Singapore's PDPA, a data breach that is likely to cause significant harm to affected individuals, or that affects 500 or more individuals, is notifiable — to the PDPC within three calendar days of assessing it, and to affected individuals as soon as practicable. A leaked 9.9 order export with names, phone numbers and addresses reaches 500 individuals very easily. That turns a housekeeping task into an obligation with a clock attached.

Which accounts should you revoke first?

Work in this order, because it maps to what causes the most damage fastest:

1. Anything touching money. Marketplace seller accounts, payment gateway dashboards, bank and PayNow access, refund permissions. Change any password that was shared verbally or over chat during the sale — assume it is public.
2. Anything touching customer data. CRM, order management, email and WhatsApp broadcast tools. These are your PDPA exposure.
3. Anything touching fulfilment. Courier portals, warehouse or 3PL logins, inventory adjustment rights. Compromise here shows up as stock variance you'll misread as theft or miscounting.
4. Everything else — analytics, design tools, ad accounts.

For each account, the question is binary: does this person need this access next Tuesday? If not, remove it now. You can always re-grant. Re-granting takes ninety seconds; a compromised seller account takes weeks.

What about API keys and marketplace integrations?

This is the part SMEs skip, and it's the most durable risk. API keys don't leave the company when a part-timer does, don't appear in any staff list, and typically have no expiry.

Open every integration you use — marketplace connectors, stock sync tools, accounting bridges, shipping label generators — and check three things. First, which keys exist: delete any you cannot explain. Second, what scope each has: a stock sync does not need refund or payout permissions. Third, where the key is stored: if it's in a spreadsheet, a Notion page, a WhatsApp message or hardcoded in a script someone emailed you, rotate it and store the replacement properly.

If a freelance developer or agency built something for you during the sale rush, their access is part of this review too. Contractor access that quietly persists past the engagement is one of the most common findings in any SME audit.

How do you check whether something was already exploited?

You don't need tooling for a first pass. Spend twenty minutes on four checks:

• Login history on your marketplace seller centre and email — look for unfamiliar locations, devices or times.
• Linked devices in WhatsApp Business and Google — unlink anything you don't recognise.
• Payout and bank details on every marketplace and payment gateway — confirm the account number is still yours. This is the single highest-value check on the list.
• Refunds and discount codes issued since 8 September — anything you can't attribute to a real customer case deserves an explanation.

If any of those look wrong, stop the review and treat it as an incident: change credentials, enable multi-factor authentication, and document what you found and when you found it. That documentation is what a PDPA assessment is built on.

What does the 90-minute version look like?

Block ninety minutes this week, ideally with your ops lead in the room:

• 0–20 min: List every system with a login. Marketplaces, store admin, email, accounting, courier, WhatsApp, cloud storage, ad platforms.
• 20–50 min: For each, list who has access and remove anyone who doesn't need it next week.
• 50–70 min: Rotate every password shared during the sale, and enable MFA on anything money- or customer-data-related that lacks it.
• 70–85 min: Audit API keys and delete unexplained ones.
• 85–90 min: Track down exported customer files and delete the copies you no longer need.

Then write the list down. That document becomes your standing access register — and the same ninety minutes after 11.11 will take thirty.

How does this connect to October?

October is Cybersecurity Awareness Month, and it usually arrives as a pile of advisories an SME owner has no time to act on. Doing the access review now inverts that: you enter October with a current inventory of who can reach what, which is precisely the foundation the Cyber Security Agency's Cyber Essentials mark asks for under asset and access management. If certification is on your roadmap for grant eligibility or enterprise-client tenders, this week's clean-up is the first deliverable, not a detour from it.

Frequently asked questions

We only had two part-timers during 9.9. Is this really necessary?

The headcount isn't the risk — the number of doors is. Two part-timers can easily account for a shared seller password, two linked devices, three exported order files and a courier portal login. The review takes ninety minutes regardless of team size, and small teams tend to share credentials more freely, not less.

Should we do this before or after 10.10?

Before, without exception. The purpose is to stop 9.9's access debt from carrying into the next spike. Doing it after 10.10 means reviewing two sales' worth of changes at once, with worse recall of why each was granted.

What if we find that customer data was exposed?

Contain it first — revoke the access and secure the data. Then assess scope: how many individuals, what fields, and what harm is plausible. If it's likely to cause significant harm, or affects 500 or more individuals, it is notifiable to the PDPC within three calendar days of your assessment, with affected individuals informed as soon as practicable. Document your timeline as you go; the assessment record matters as much as the fix.