Fullerton Health server hit by cyberattack; personal data of migrant workers affected
Source: Straits Times
Article Date: 12 Nov 2026
Author: Rhea Yasmine
The incident involved unauthorised access to the server and appears to have affected migrant workers’ personal data.
A server supporting Fullerton Health’s Migrant Worker Primary Care Plan (PCP) programme was hit by a cybersecurity incident, said the healthcare service provider.
In a statement on its website on Nov 9, it said the incident, which involved unauthorised access to the server, appears to have affected migrant workers’ personal data.
This includes their full name, foreign identification number, date of birth, mobile number, e-mail address and residential address.
The affected data does not contain any health, medical or personal financial information, Fullerton Health said, though it did not share how many migrant workers were impacted.
Fullerton Health said it became aware of the incident on Oct 31 and promptly activated its incident response protocols.
It also implemented precautionary measures across its network to secure its systems while investigations are ongoing.
It said it had notified the Personal Data Protection Commission (PDPC), made a police report and is in contact with the Ministry of Manpower (MOM), which administers the PCP.
“We are cooperating fully with the relevant authorities,” it added.
The PCP aims to provide eligible workers in Singapore with accessible and affordable healthcare.
It is mandatory for employers here to buy a PCP for certain work permit and S Pass holders, such as those who work in the construction, marine shipyard or process sectors.
A PDPC spokesperson said the commission is aware and investigating the case.
Fullerton Health said in its statement that the incident appears to be limited to a specific standalone system supporting its PCP programme, adding that there is no evidence so far that systems supporting other programmes, projects, clients or patients have been affected.
The healthcare service provider said all its managed care services, healthcare services and facilities remain operational.
It is taking steps to notify affected migrant workers and provide them with information on the incident as well as where they can seek further assistance.
Noting that some of those affected may need more help in understanding how they have been affected and what precautionary steps they can take to protect themselves, Fullerton Health said it will provide guidance as part of the notification process.
“Protecting personal information is one of Fullerton Health’s highest priorities and we deeply value the trust that our stakeholders have placed in us.
“We sincerely regret any concern or uncertainty this incident may have caused,” it said, adding that investigations are ongoing.
It added that updates will be provided as more verified information becomes available.
The Straits Times has contacted Fullerton Health and MOM for more details.
The cyberattack at Fullerton Health comes on the heels of recent data breaches at other local companies and platforms, including Tappee, M1 and Singapore Airlines (SIA).
Student details were compromised after four schools were affected in a cybersecurity incident at Tappee, an app for ordering school meals.
Last week, SIA said about 46,000 booking records at the airline were affected by a data breach at its reservation-technology provider, Amadeus.
On Oct 30, local telco M1 suffered a data breach that compromised customers’ data.
Source: The Straits Times © SPH Media Limited. Permission required for reproduction.
2