Fullerton Health reports cyber incident affecting migrant worker personal data
A cybersecurity breach on a server supporting Fullerton Health's Migrant Worker Primary Care Plan exposed personal details of workers, prompting investigations by authorities.
Fullerton Health said a server used for its Migrant Worker Primary Care Plan (PCP) programme suffered unauthorised access, potentially exposing personal information of migrant workers in Singapore. The data involved includes names, foreign identification numbers, dates of birth, mobile numbers, e-mail addresses and residential addresses, but does not contain health, medical or financial details. The provider did not disclose the number of workers affected.
The company became aware of the breach on Oct 31 and activated its incident-response protocols, securing its network while investigations continue. It has reported the matter to the Personal Data Protection Commission, filed a police report and is cooperating with the Ministry of Manpower, which oversees the PCP scheme.
“We are cooperating fully with the relevant authorities,” Fullerton Health said in a statement.
A PDPC spokesperson confirmed the commission is aware of the case and is investigating. Fullerton Health added that the breach appears limited to the standalone system supporting the PCP programme, with no evidence of impact on other services, projects, clients or patients. All managed-care services and facilities remain operational.
The provider plans to notify affected workers, offering guidance on protecting their information. It reiterated that safeguarding personal data is a top priority and expressed regret for any concern caused.
The incident follows recent data breaches at other Singapore entities, including the school-meal app Tappee, telecom M1 and airline Singapore Airlines' reservation-technology provider Amadeus.