97,000 records tied to valid passes. The count took 14 days to surface
Fullerton Health says about 140,000 work pass holder records were compromised in a breach of the server behind its Migrant Worker Primary Care Plan programme, the company told CNA on 14 November. About 43,000 of those records belonged to people whose work passes are no longer valid. That leaves roughly 97,000 records tied to people whose work passes are still valid. The 97,000 figure is our calculation from the company’s own numbers, not a figure Fullerton Health published.
Fullerton Health is one of four anchor operators appointed by Singapore’s Ministry of Manpower to run the primary care plan for migrant workers, The Straits Times reported. The breach hit a standalone server supporting that programme, and the ministry administers the plan.
Fourteen days from discovery to a number
Fullerton Health became aware of the incident on 31 October, CNA reported. It notified the Ministry of Manpower on 2 November, and posted a public notice on its own website on 9 November without saying how many workers were affected. The 140,000 figure only came out on 14 November, in replies to questions from CNA and The Straits Times. That is 14 days from discovery to a number, and five days from the public notice to a number.
The count surfaced in response to media queries, not in Fullerton Health’s own public notice.
What was taken, and what was not
The records that may have been affected hold migrant workers’ full names, foreign identification numbers, dates of birth, mobile numbers, email addresses and residential addresses, according to CNA. “No health, medical or personal financial information was compromised in the incident,” Fullerton Health said.
A name, a foreign identification number, a birth date and a home address is enough to impersonate someone, and it needs no medical record or bank detail to do it.
What Fullerton Health has done since
The company said it promptly isolated the affected standalone server after discovering the incident and put network-wide security measures in place, CNA reported. It is building an entirely new server, with security measures in place from the outset, to serve as a new PCP Enrolment Portal, and the affected server will not be reused.
Preliminary investigations by Fullerton Health’s security monitoring provider, Logicalis, found no evidence of abnormalities or breaches across the other Fullerton Health IT assets under its monitoring, CNA reported. Fullerton Health notified the Personal Data Protection Commission, lodged a police report and is in contact with the Ministry of Manpower. It has made two rounds of notifications to affected migrant workers through their employers, and the ministry has also notified affected workers directly through its FWMOMCare mobile application, with notifications in workers’ native languages. Both Fullerton Health and the ministry stressed that the incident has not disrupted migrant workers’ access to the plan, and workers can continue to seek medical care as usual, The Straits Times reported.
Six healthcare breaches in three weeks, and only three with a count
Fullerton Health is one of a string of recent healthcare breaches in Singapore, according to CNA’s own list of the incidents. Only three of the six put a number on what was exposed.
| Incident | Reported | Count disclosed | Data exposed |
|---|---|---|---|
| Alliance Medinet | 24 Oct 2026 | About 110,000 members | Names, ID numbers, contact details |
| Doctor Anywhere | 6 Nov 2026 | Not disclosed | Personal data leaked; types not disclosed |
| Fullerton Health | 9 Nov 2026 | About 140,000 records | Names, FINs, birth dates, contacts, addresses |
| Dementia Singapore, CARA SG app | 11 Nov 2026 | Not disclosed | Names, emails, phones, membership IDs |
| Minmed Group | 11 Nov 2026 | Not disclosed | Types not disclosed; clinical records unaffected |
| Agency for Integrated Care | 12 Nov 2026 | Up to 4,064 staff | Names, contact details, NRIC numbers |
Fullerton Health is the largest counted breach in the wave, about 27% larger than Alliance Medinet’s 110,000, by our calculation. Three of the six incidents disclosed no count at all, so this is the largest of the three that put a number on it, not necessarily the largest of the six. Alliance Medinet’s entry carries a caveat: CNA also reports bank details of seven members and one member’s medical diagnosis might have been affected.
Singapore’s Personal Data Protection Commission said on 13 November that the recent spate of data breaches appears to have been the result of opportunistic attacks, with no clear connection between them, CNA reported. Preliminary indications were that the significant breaches resulted from opportunistic attacks exploiting common vulnerabilities in IT systems. Singapore’s Cyber Security Agency said the same day that the average monthly number of reported cyber incidents since September has been three times the January-to-August average, but they do not appear to be part of coordinated campaigns targeting Singapore. The agency said they reflect a broader global trend of opportunistic attacks.
What should I do if my Fullerton Health record was exposed?
Treat any unsolicited message asking for personal information as suspect and confirm it through your employer or the FWMOMCare app. Your FIN, birth date and home address may have been affected, so expect phishing that uses them. Never share documents or one-time codes over an unsolicited call or message.
- Verify any contact about the breach first through your employer or the official FWMOMCare app.
- Expect phishing messages that could use your real name, FIN, birth date and home address.
- Never share documents, passwords or one-time codes over an unsolicited call or message from anyone.
- Check your accounts for logins from unusual places, unexpected setting changes, or lockouts you did not cause.
- Report anything suspicious to your employer straight away, so it reaches Fullerton Health and the authorities.
- Watch for official messages in your own language, since MOM sent its FWMOMCare notices in workers’ native languages.
Fullerton Health advised migrant workers to exercise caution when responding to unsolicited emails, phone calls, text messages or other communications requesting personal information, CNA reported.
What is confirmed, and what is not
Confirmed: about 140,000 work pass holder records were compromised, including about 43,000 tied to passes that are no longer valid. Names, foreign identification numbers, dates of birth, mobile numbers, email addresses and residential addresses may have been affected. No health, medical or personal financial information was compromised. The company knew on 31 October, told the ministry on 2 November, posted a public notice on 9 November and disclosed the count on 14 November. The affected server was isolated, a new one is being built, and the old one will not be reused. Fullerton Health notified the data protection regulator, lodged a police report and is in contact with the ministry.
Not confirmed: whether the exposed data has been misused, sold or published. Neither CNA nor The Straits Times reports any evidence of misuse, sale or public posting, and neither reports a statement from Fullerton Health saying the data was not misused. No threat actor has been identified, and no attack method has been named. The regulator’s description of the recent breaches as opportunistic attacks is a preliminary indication about the spate generally, not a confirmed attribution for Fullerton Health. And because three of the six recent healthcare breaches disclosed no count, nobody can yet say whether Fullerton Health is the largest of the six.
What to watch next
First, any evidence that the data is being misused, sold or posted, which would change the story from exposure to active harm. Second, whether Fullerton Health or the regulator names the attack method or the vulnerability that was exploited. Third, whether Doctor Anywhere, Minmed Group or Dementia Singapore disclose affected counts, which would change the ranking in the wave. And fourth, any investigation outcome or enforcement action from the Personal Data Protection Commission.
