Fullerton Health Data Breach: Migrant Workers' FIN Numbers and Addresses Exposed in Server Attack

Fullerton Health says someone gained unauthorised access to a server supporting its Migrant Worker Primary Care Plan programme, which the Ministry of Manpower (MOM) administers. The healthcare provider's 9 November notice lists the exposed data as full name, FIN number, date of birth, mobile number, email and home address. The Straits Times notes the company "did not share how many migrant workers were impacted".

What was hit

Fullerton found out on 31 October, nine days before its notice went up. Its notice says the data "does not contain any health/medical or personal financial information", and that the breach looks confined to "a specific standalone system supporting our PCP programme". Its clinics and managed care services remain operational.

The company hasn't said when the access began or how the attacker got in.

Employers must buy the plan for certain work permit and S Pass holders in construction, marine shipyards and process plants. Fullerton is due to serve about 100,000 workers in the West under the enhanced scheme from April 2027. That is the size of its zone, not a count of victims.

Who has been told

Fullerton has notified the Personal Data Protection Commission (PDPC), made a police report and is in contact with MOM. The Straits Times says it asked the PDPC and MOM for details; its report carries no reply from either.

Other breaches

A 2021 breach at its vendor Agape exposed patients' "names, NRIC or identity numbers and contact details", and the PDPC ruled on that case in June 2023.

Two other Singapore breaches were disclosed on 10 November: attacks on five SPH Media systems and student records leaked through the Tappee school meal app.

What workers are told

Fullerton says it is notifying affected workers directly and "will provide guidance as part of the notification process". It hasn't yet published specific steps or an incident hotline.