Which Singapore companies have been breached this month? At least four in a single week. SPH Media, publisher of The Straits Times, said on Tuesday 10 November that five of its systems had been hit by cyberattacks believed to be "a concerted effort that was carried out by the same threat actor", CNA reported. Telco M1 and telehealth provider Doctor Anywhere reported breaches on 6 November, and on 10 November SATS said a school meal ordering app it runs had leaked student data.
None of the companies has reported stolen card or bank details. But the data that did leak, names, addresses, phone numbers and in M1's case identity card numbers, is exactly what scammers use to make phishing messages convincing. And the school app breach exposed children's health related information, raising hard questions about how much data apps collect and how well third party vendors protect it.
What happened at SPH Media
SPH Media said the attacks hit two groups of systems: some that contained personal data and some that did not. The compromised information included mostly email addresses, names, mailing addresses and phone numbers, amounting to 9 percent of the company's database. "No payment card details, financial or banking information, or customer account access was compromised," a spokesperson said.
The first incident was detected on 4 November and the latest on 8 November. SPH Media said it secured the affected systems, brought in external cybersecurity experts, and reported the matter to the Personal Data Protection Commission, the Cyber Security Agency, the Infocomm Media Development Authority and the police. It said it could not yet confirm whether the attacks were AI enabled while investigations continue.
In a joint statement, IMDA, the PDPC and the CSA said they had asked SPH "to contain the impact and identify the root cause of the incident". IMDA and the PDPC are investigating, while the CSA is monitoring developments.
The school meal app that leaked children's data
Tappee, a meal ordering app used in four Singapore schools, suffered "malicious access by an unauthorised external party", said SATS, the food solutions group that operates it. The compromised data includes student names, email addresses, financial assistance statuses, student concession card numbers and some parents' and guardians' email addresses, according to CNA.
A small number of records also contained students' height, weight, allergy profiles and caloric intake data. SATS said the access came through a vulnerability in the Tappee platform, which is built and maintained by a third party vendor, Serial Multivision, and that its own IT systems were not compromised. It suspended the app, moved meal orders to the schools and said meal provision has not been affected.
SATS has not named the schools, citing the privacy of students and families. It has notified the PDPC, which says it is investigating, and is contacting affected individuals. "We recognise the concern this incident may cause affected students, parents and schools, and sincerely apologise," SATS said.
Every breach this week started with data someone decided to keep. The safest record is the one a company never collected.
M1, Doctor Anywhere and a pattern
The M1 breach, reported on 6 November, exposed customers' names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses. That combination is valuable to criminals because it can be used to impersonate people, answer security questions or craft highly targeted scams.
Doctor Anywhere also reported a leak of users' personal data, though cybersecurity firm Ensign InfoSecurity said clinical records were not affected. Separately, about 46,000 Singapore Airlines booking records were accessed in a breach involving the travel software provider Amadeus, part of a wider incident we covered in our report on the Amadeus breach that hit Malaysia Airlines and other carriers.
The common thread is third parties and accumulated data. Several incidents involve vendors or platforms that hold large amounts of customer information, and attackers are increasingly targeting the weakest link in a supply chain rather than a company's main systems. Regional regulators have been tightening cooperation, as in the MAS and Bank of Thailand cybersecurity agreement.
What Singapore's law requires
Singapore's Personal Data Protection Act sets clear duties when a breach happens. Organisations must assess a suspected breach quickly and, if it is likely to cause significant harm or affects 500 or more people, notify the PDPC within three calendar days of deciding it is notifiable, and tell affected individuals where required. Each of the companies involved this week says it has reported to the commission.
Penalties can be heavy. Since 2022, the PDPC can impose fines of up to 10 percent of an organisation's annual turnover in Singapore for companies with turnover above 10 million Singapore dollars, or up to 1 million Singapore dollars otherwise. In past cases, the commission has also held organisations responsible for weaknesses in the systems of vendors they rely on.
That last point is central to the Tappee case. SATS says the vulnerability was in a platform built and maintained by its vendor. Under Singapore's approach, the organisation that collects the data is generally still accountable for how it is protected, which is why companies are expected to check the security of the apps and service providers they hire.
What you should do now
If you are a customer of any of these companies, or a parent at an affected school, the main risk is phishing and impersonation rather than direct theft from your bank account. Authorities urged the public to "remain vigilant to potential phishing attempts and scams". Practical steps include:
- treat unexpected calls, SMS and emails that mention your account or personal details with suspicion
- never share one time passwords or Singpass details, whatever the caller claims
- check official notices from the company directly rather than through links in messages
- enable two factor authentication and change passwords that are reused elsewhere
- watch for unusual activity on mobile, bank and subscription accounts
For companies, the week is a warning. Regulators expect firms to contain breaches quickly, notify the authorities and affected people, and fix root causes, including weaknesses in vendors' systems. With several investigations open at once, the PDPC's findings and any penalties will set expectations for how Singapore businesses manage third party risk.
Was SPH Media hacked?
Yes. SPH Media said five of its systems were hit by cyberattacks between 4 and 8 November 2026, believed to be by the same threat actor.
What data was leaked in the SPH Media breach?
Mostly names, email addresses, mailing addresses and phone numbers, about 9 percent of its database.
Was payment information stolen from SPH Media?
No. SPH Media said no payment card, financial or banking data and no account access was compromised.
Who is investigating the SPH Media breach?
The PDPC and IMDA are investigating, and the Cyber Security Agency is monitoring.
What is Tappee?
A school meal ordering app used in four Singapore schools, operated by SATS and built by vendor Serial Multivision.
What student data was exposed in the Tappee breach?
Names, email addresses, financial assistance status, concession card numbers and some parents' emails, plus a few records with height, weight, allergy and calorie data.
Which schools were affected by the Tappee breach?
SATS has not named the four schools, citing privacy.
Are school meals affected?
No. SATS says orders are being handled through the schools and meal provision continues.
What was leaked in the M1 data breach?
Names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses.
Were Doctor Anywhere medical records leaked?
Ensign InfoSecurity said clinical records were not affected, though users' personal data was leaked.
Were the attacks AI enabled?
SPH Media said it cannot confirm whether AI was used while investigations continue.
What should I do if my data was leaked?
Be wary of phishing, never share one time passwords, verify notices directly with the company and enable two factor authentication.
Can I be scammed with leaked data?
Yes. Names, phone numbers and identity numbers can make scam calls and messages more convincing.
Was Singapore Airlines data affected?
About 46,000 Singapore Airlines booking records were accessed in a separate breach involving Amadeus.
Will the companies be fined?
That depends on the PDPC's investigations, which can lead to financial penalties under Singapore's data protection law.
How fast must Singapore companies report a data breach?
Under the PDPA, within three calendar days of assessing that a breach is notifiable.
Singapore's breach week did not empty anyone's bank account, but it put the personal details of many customers, and some children's health data, into the wrong hands. The fallout will come through scams and regulatory findings, and the lesson for companies is to collect less, check their vendors and assume attackers will try the weakest door first.
Talk to the SpinDepth deskYou've finished this story
Read on, send it to someone, or ask about it.
