Fullerton Health server hit by cyberattack; personal data of migrant workers affected
Fullerton Health reported unauthorised server access affecting migrant workers’ personal details. Health and financial data were not exposed; authorities were notified and affected workers will be contacted.
Nov 11, 2026, 03:09 PM
- Fullerton Health said a server for its Migrant Worker Primary Care Plan was hit by unauthorised access. It found the incident on Oct 31 and alerted PDPC, the police and the Ministry of Manpower.
- Initial checks suggest migrant workers’ personal data may have been affected, including names, FIN numbers, birth dates, contacts and addresses. No health or financial data was exposed, and other systems appear safe.
- The company said all services and facilities are still running. It will notify affected workers, give guidance, and share updates as investigations continue.
SINGAPORE – A server supporting Fullerton Health’s Migrant Worker Primary Care Plan (PCP) programme was hit by a cybersecurity incident, said the healthcare service provider.
In a statement on its website on Nov 9, it said the incident, which involved unauthorised access to the server, appears to have affected migrant workers’ personal data.
This includes their full name, foreign identification number, date of birth, mobile number, e-mail address and residential address.
The affected data does not contain any health, medical or personal financial information, Fullerton Health said, though it did not share how many migrant workers were impacted.
Fullerton Health said it became aware of the incident on Oct 31 and promptly activated its incident response protocols.
It also implemented precautionary measures across its network to secure its systems while investigations are ongoing.
It said it had notified the Personal Data Protection Commission (PDPC), made a police report and is in contact with the Ministry of Manpower (MOM), which administers the PCP.
“We are cooperating fully with the relevant authorities,” it added.
The PCP aims to provide eligible workers in Singapore with a ccessible and affordable healthcare. It is mandatory for employers here to buy a PCP for certain work permit and S Pass holders, such as those who work in the construction, marine shipyard or process sectors.
A PDPC spokesperson said the commission is aware and investigating the case.
Fullerton Health said in its statement that the incident appears to be limited to a specific standalone system supporting its PCP programme, adding that there is no evidence so far that systems supporting other programmes, projects, clients or patients have been affected.
The healthcare service provider said all its managed care services, healthcare services and facilities remain operational.
It is also taking steps to notify affected migrant workers and provide them with information on the incident as well as where they can seek further assistance.
Noting that some of those affected may need more help in understanding how they have been affected and what precautionary steps they can take to protect themselves, Fullerton Health said it will provide guidance as part of the notification process.
“Protecting personal information is one of Fullerton Health’s highest priorities and we deeply value the trust that our stakeholders have placed in us. We sincerely regret any concern or uncertainty this incident may have caused,” it said, adding that investigations are ongoing.
It added that updates will be provided as more verified information becomes available.
The Straits Times has contacted Fullerton Health and MOM for more details.
The cyberattack at Fullerton Health comes on the heels of recent data breaches at other local companies and platforms including Tappee, M1 and Singapore Airlines (SIA).
Student details were compromised after four schools were affected in a cybersecurity incident at Tappee, an app for ordering school meals.
Last week, SIA said about 46,000 booking records at the airline were affected by a data breach at its reservation-technology provider, Amadeus.
On Oct 30, local telco M1 suffered a data breach that compromised customers’ data.
Source: The Straits Times https://www.straitstimes.com/singapore/fullerton-health-server-hit-by-cyberattack-personal-data-of-migrant-workers-affected
