M1 Data Breach Exposes Customers' NRIC Numbers, Addresses and Phone Numbers
M1 data breach: the Singapore telco says customer names, NRIC/FIN numbers, birth dates, phone numbers and addresses were exposed on 30 October. Payment data was not, it says.
Singapore telco M1 said on 6 November that it had suffered a data breach on 30 October. Notification emails seen by AsiaOne list the exposed data as customer names, NRIC/FIN numbers, birth dates, mobile phone numbers, email addresses and addresses. The first went out at about 8pm on 6 November. M1 says it is alerting affected customers by email or letter.
M1 didn't say how many customers were affected, or how the intruder got in.
What M1 says was not taken
The telco says no payment card details, financial or banking information, or customer account access was compromised. Its services and business operations were unaffected throughout the incident, and the breach has been contained, M1 told The Straits Times in a statement carried by Yahoo News.
Who is investigating
M1 says it's working with "the relevant authorities and third-party specialists". It names neither. The Personal Data Protection Commission said on 6 November that it is aware of the incident and investigating.
Other recent Singapore incidents
On 6 November the telehealth operator Doctor Anywhere also disclosed a breach of its users' personal data. In February 2026, M1 was named among four Singapore telcos breached by the UNC3886 espionage group in 2025, a campaign in which authorities found no evidence that sensitive customer data was taken. That investigation drew over a hundred investigators from six government agencies.
What M1 tells customers to do
Be careful when responding to unsolicited calls, messages or e-mails, M1 advises, and verify the identities of those who contact you via official channels.
More news
Vietnam Flags More Than 668,000 Bank and E-Wallet Accounts With Signs of Law Violations
Vietnam's State Bank monitoring system has flagged more than 668,000 bank, e-wallet and payment accounts showing signs of law violations, a senior officer of the police cyber unit A05 said.
Pattaya Mule Account Raid: Police Arrest Five Thais and Three Chinese Men, Losses Put at Over 100 Million Baht
Pattaya mule account raid: Thai police arrested eight people in a condominium on 5 November and link the ring to online fraud losses of more than 100 million baht nationwide.
CSA Tells Singapore Firms to Take OT Control Systems Off the Internet After Europe's Fridge Attacks
CSA tells Singapore firms to take operational technology control systems off the public internet after attacks on supermarket fridges in Europe. It has no reports of similar incidents here.