The message arrived on a phone that rarely stops buzzing. It came through an app the worker opens to check his clinic appointments, and it carried news he never expected to hear from his healthcare provider.
His personal details had been exposed in a cyberattack. He is one of about 140,000 migrant workers in Singapore whose records were caught up in a breach at Fullerton Health, one of the country’s largest healthcare groups.
The number only became public on Saturday, November 14, two weeks after the company first discovered the intrusion. For fourteen days, the workers affected had no idea how many of them were involved, or whether their own records were among them.
What happened in the Fullerton Health breach
Fullerton Health said it became aware of the unauthorised access on October 31, 2026. The target was a standalone server supporting its Migrant Worker Primary Care Plan, known as the PCP, a government-administered programme that gives eligible migrant workers access to affordable primary healthcare.
The company notified Singapore’s Ministry of Manpower on November 2. A week later, on November 9, it published a notice on its website confirming that a server had been accessed without authorisation. That notice said nothing about how many workers were affected.
The scale only emerged on Saturday, November 14, when Fullerton Health answered questions from Channel NewsAsia and The Straits Times. About 140,000 work pass holder records were compromised, the company said. Of those, around 43,000 belonged to people whose work passes were no longer valid.
Fullerton Health is one of four anchor operators appointed by the Ministry of Manpower to administer the PCP, alongside SATA CommHealth, St Andrew’s Mission Hospital and StarMed Medical Group. The plan is a lifeline for the workers who build Singapore’s towers, clean its streets and staff its factories.
What data was exposed — and what was not
According to the company’s preliminary investigation, the records that may have been exposed include workers’ full names, foreign identification numbers, dates of birth, mobile phone numbers, email addresses and residential addresses.
That combination is exactly the kind of detail identity thieves prize. A name plus a foreign identification number plus a date of birth is often enough to open the door to fraud, from fake accounts to phishing messages that look convincingly real.
There was one piece of reassurance in the company’s statement. Fullerton Health stressed that no health, medical or personal financial information was compromised in the incident. The exposed server supported enrolment in the care plan, not the clinical records of the workers it covers.
The distinction matters, but it does not erase the risk. Contact details and identification numbers can still be used to target people, especially workers who may be less familiar with the warning signs of a scam in a foreign language.
How Fullerton Health responded to the breach
The company said it isolated the affected server after discovering the incident and put precautionary measures in place across its network. The old server will not be reused. Instead, Fullerton Health is building a new server, with security measures built in from the start, to host a new enrolment portal for the care plan.
Its security monitoring provider, Logicalis, carried out a preliminary probe and found no evidence of abnormalities or breaches across the other Fullerton Health IT assets it monitors. That finding is preliminary, and the investigation is still going on.
Fullerton Health confirmed it has notified Singapore’s Personal Data Protection Commission, lodged a police report, and stayed in close contact with the Ministry of Manpower since it was first told of the breach on November 2.
The ministry, for its part, has notified affected workers directly through its FWMOMCare mobile application, in their own languages. Fullerton Health said it has also completed two rounds of notifications through employers, so the message reaches workers even if they do not check the app.
Why the two-week wait for the number matters
Fullerton Health knew about the intrusion on October 31. It told the ministry two days later and the public nine days after that. But the number of people affected — the single fact most workers would want to know — took another five days to surface, and only in response to reporters’ questions.
The company has not explained why the figure took so long to confirm. Investigations take time, and counting affected records is rarely a simple exercise. But for the workers involved, the silence left a gap that rumour and worry could fill.
The delay is not unique to Fullerton Health. Companies often disclose a breach first and the scale later, as forensic teams work out what was taken. Regulators in Singapore and elsewhere have been pushing for faster, fuller disclosure, precisely because the people affected cannot protect themselves until they know they are at risk.
What is clear is that the workers were not left without care. Both Fullerton Health and the Ministry of Manpower stressed that the incident has not disrupted access to the PCP, and workers can continue to seek medical care as usual while the investigation continues.
Singapore’s string of data breaches
The Fullerton Health incident is the latest in a string of data breaches to hit Singapore in recent weeks. It follows the Fireworks AI breach and the Uber data breach, which exposed drivers’ licence details through the same AI vendor.
Singapore’s Personal Data Protection Commission said preliminary information indicated the recent incidents were opportunistic attacks exploiting common IT system vulnerabilities, with no apparent link between them.
The Cyber Security Agency of Singapore said on Friday, November 13, that these incidents did not appear to be coordinated attacks targeting the country. The picture, in other words, is not a single campaign aimed at Singapore, but a wave of separate attacks finding the same kinds of weaknesses.
That is a familiar pattern in cybersecurity. Attackers scan for common flaws — unpatched software, misconfigured servers, weak credentials — and strike wherever they find an opening. A standalone server supporting a single programme can be just as attractive a target as a flagship system.
The Cursor security breach showed the same chain reaction, when a single leaked key opened the door to a much wider compromise.
The Fullerton Health breach fits that pattern. The compromised server was a standalone machine supporting one programme, not the company’s core network. Yet it held the personal details of 140,000 people, a reminder that sensitive data often sits in quiet corners of an organisation’s systems.
What affected workers should do now
Workers who received a notification should treat unexpected calls, messages or emails asking for personal details with suspicion. Scammers often strike in the weeks after a breach, when the stolen details are fresh and the victims are already anxious.
Anyone who believes their details have been misused should report it to the police and to the Ministry of Manpower. Keeping a record of suspicious messages can help investigators trace how the stolen data is being used.
Employers also have a role to play. Many migrant workers rely on their employer for information about official notices, and Fullerton Health’s two rounds of notifications through employers suggest the company understands that the message does not always reach the worker directly.
For now, the most important fact is simple: no medical or financial data was taken, and access to healthcare has not been interrupted. The exposed details are serious, but they are not the whole of a person’s identity, and the authorities have moved to limit the damage.
What happens next in the Fullerton Health investigation
The investigation is still under way, and Fullerton Health has not said who was behind the attack or how the intruders got into the server. The police report and the Personal Data Protection Commission’s involvement mean the incident will be examined from more than one direction.
The new enrolment portal, built on a fresh server with security designed in from the beginning, will be the most visible test of whether the company has learned from the breach. Rebuilding from scratch is expensive and slow, but it is also the clearest signal that the old setup is being left behind.
For the 140,000 workers whose records were exposed, the next step is watchfulness. The breach is a reminder that the personal data of the people who build a city can be just as valuable to criminals as the data of the people who live in its penthouses — and that protecting it is not optional.
As Channel NewsAsia reported, the company first disclosed the incident on November 9, and the scale of the breach only became clear five days later. The full picture may still be some way off.
