Skip to content
Tuesday, 10 November 2026Threat Detection & DefenceCyber SafetyIdentity & AccessDevices & IoTCloud Security
Wire
01Tappee Data Breach: SATS School Meal App Exposes Student Records at Four Singapore Schools02Tamil Nadu Panchayat Accounts Cyber Fraud: ₹22 Crore in Rural Health Grants Moved Out Through a Bank Portal03Chrome Zero-Day CVE-2026-125350: Google Patches an Exploited XML Flaw in Chrome 15704Thai Airways Amadeus Data Breach: 60,529 Passenger Booking Records Accessed, Card Data Not Affected
NewsCyber Safety

Tappee Data Breach: SATS School Meal App Exposes Student Records at Four Singapore Schools

Tappee data breach: an outsider got into SATS's school meal-ordering app through a flaw and reached student names, concession card numbers and some allergy records at four schools.

Cybersecurity ASEAN editors · 1 min read
Tappee Data Breach: SATS School Meal App Exposes Student Records at Four Singapore Schools

SATS, the Singapore caterer, said on 10 November that an outside party broke into its school meal-ordering app, Tappee, "through a vulnerability in the Tappee platform". By its account the intruder reached student names and email addresses, financial assistance status and concession card numbers, along with some parents' email addresses. The app is "currently used in four schools in Singapore". The Straits Times notes that the statement did not say how many people were affected or when SATS found the breach.

Health data in some records, no payment data

SATS says "a small number of records contain information on height and weight profile, allergy profile and caloric intake data".

The company says no banking details, card numbers or images of student ID documents were compromised, and that "our own IT infrastructure has not been compromised". It has declined to name the four schools, citing the privacy of affected students and families.

A vendor-built app

Tappee, launched in January 2023, was built and is maintained by a third-party vendor, Serial Multivision. SATS says its cybersecurity monitoring detected the access, and that it then "immediately instructed Serial to suspend access to the Tappee application". Neither company has described the flaw.

The app is "temporarily unavailable as a precautionary measure" while SATS's security staff and the vendor fix it. SATS says meal provision hasn't been affected, and orders are "currently being managed directly through participating schools".

Regulators

SATS notified the Personal Data Protection Commission on 10 November, and the commission told The Straits Times it is investigating. The Cyber Security Agency of Singapore has contacted SATS to offer assistance. The paper's report carries no reply from the Ministry of Education.

What parents are told

SATS says it has contacted the schools and is notifying affected people directly, and that it will be "providing them with appropriate guidance and support". It hasn't published that guidance.

More news