Fullerton Health reports breach affecting 140,000 migrant worker records

Fullerton Health confirmed that a cybersecurity incident involving its Migrant Worker Primary Care Plan (PCP) programme exposed personal data of roughly 140,000 work pass holders, including full names, foreign identification numbers, dates of birth, mobile numbers, email addresses and residential addresses. About 43,000 of the affected records belonged to individuals whose work passes were no longer valid, the provider said in response to CNA queries.

The company said no health, medical or personal financial information was compromised. It isolated the affected server after discovery on Oct. 31 and is building a new server with security measures to replace the PCP enrolment portal. Fullerton Health said its security monitoring provider, Logicalis, found no evidence of abnormalities across the provider’s IT assets.

Fullerton Health has notified affected workers through their employers and advised them to be cautious of unsolicited communications requesting personal information. Singapore's Ministry of Manpower also sent notifications via its FWMOMCare mobile app in workers' native languages.

The breach follows a series of recent data incidents affecting other Singaporean organisations, including M1, Singapore Airlines and several healthcare providers. The Personal Data Protection Commission described the recent breaches as opportunistic attacks exploiting common IT vulnerabilities, while the Cyber Security Agency noted a rise in reported cyber incidents and is working with critical infrastructure sectors to strengthen defences.