SINGAPORE, Nov 11 — Migrant workers in Singapore may have had their identification numbers, home addresses and other personal details compromised in a cyberattack on healthcare provider Fullerton Health, with the number of people affected still unknown.

The breach involved unauthorised access to a server supporting the company’s Migrant Worker Primary Care Plan (PCP), a healthcare scheme for foreign workers, The Straits Times reported.

In a statement on November 9, Fullerton Health said the potentially affected information included workers’ names, Foreign Identification Numbers (FIN), dates of birth, mobile phone numbers, email addresses and residential addresses.

However, the company said no medical records, health information or personal financial details were involved.

It did not disclose how many workers may have been affected, leaving the scale of the breach unclear.

Fullerton Health said it discovered the incident on October 31 and immediately activated its cybersecurity response procedures, introducing additional safeguards while investigations continue.

Singapore’s Personal Data Protection Commission (PDPC) has been notified, a police report lodged and the Ministry of Manpower (MOM), which administers the PCP scheme, informed.

“We are cooperating fully with the relevant authorities,” the company said.

The incident comes amid a spate of cybersecurity breaches in Singapore, with telco M1, telehealth provider Doctor Anywhere and Singapore Airlines reporting data compromises earlier this month. The airline incident involved records held by its technology provider, Amadeus.

Yesterday, SPH Media disclosed cyberattacks affecting five of its systems, while school meal-ordering app Tappee was hit by a separate breach involving students’ personal information across four schools, according to CNA.

The PCP programme is designed to provide affordable primary healthcare to eligible migrant workers. Employers must purchase coverage for certain work permit and S Pass holders, including those employed in construction, marine shipyards and industrial processing.

Fullerton Health said preliminary findings suggested the breach was confined to a standalone system supporting the programme.

There was no evidence that other healthcare programmes, clients or patients had been affected, it added.

The company also stressed that its healthcare facilities and managed care services remained operational.

Fullerton Health said it was contacting affected workers and would provide guidance on precautionary measures, acknowledging that some might need additional assistance understanding the implications of the breach.

“Protecting personal information is one of Fullerton Health’s highest priorities and we deeply value the trust that our stakeholders have placed in us. We sincerely regret any concern or uncertainty this incident may have caused,” it said.

Investigations are continuing, with further updates expected as information is verified.