Singapore healthcare provider Fullerton Health has confirmed that about 140,000 work pass holder records were compromised when someone gained unauthorised access to a server behind its Migrant Worker Primary Care Plan (PCP) programme. The Ministry of Manpower (MOM) administers the PCP. On November 14, in reply to questions from CNA, the company said about 43,000 of those records belong to people whose work passes are no longer valid. It found the intrusion on October 31 but did not publish a notice until November 9, and that first notice gave no victim count. The 140,000 figure is the only one published so far. It comes from the company's own statement to CNA, and no other outlet or regulator has given a different number.
What Happened
Fullerton Health says it became aware on October 31, 2026 of unauthorised access to "a server supporting our Migrant Worker Primary Care Plan (PCP) programme". The company says it activated its incident response protocols, isolated the affected server and put precautionary measures in place across its network.
Its public notice went up on its website on Monday, November 9, nine days after discovery. CNA, The Straits Times, AsiaOne, Malay Mail and The Online Citizen all reported the incident on November 11. Malay Mail's summary says Fullerton Health "disclosed" the incident on October 31. That conflicts with the company's own notice, which gives October 31 as the date it discovered the breach and November 9 as the date it went public.
Fullerton Health has notified the Personal Data Protection Commission (PDPC), made a police report and is in contact with MOM. The Online Citizen reports that the PDPC told CNA it is aware of the incident and is investigating. The company says the breach appears limited to "a specific standalone system" and that it has no evidence so far that systems for other programmes, clients or patients were affected. It says all its managed care services, healthcare services and facilities have stayed open.
In its November 14 update, the company said its security monitoring provider, Logicalis, found no abnormalities or breaches across the Fullerton Health IT assets it monitors, based on a preliminary review. That wording only covers assets inside Logicalis's monitoring scope. The company has not said whether the compromised PCP server was one of them.
What Was Taken
Fullerton Health's preliminary findings say these personal details of migrant workers may have been affected:
- Full name
- Foreign Identification Number (FIN)
- Date of birth
- Mobile number
- Email address
- Residential address
The company says no health, medical or personal financial information was involved. On volume, it told CNA about 140,000 work pass holder records were compromised, about 43,000 of them belonging to former pass holders whose passes are no longer valid. That means the server was keeping identity and address data for tens of thousands of people who may no longer be in the programme or in Singapore.
The company's own language is cautious: its notice says data "may have been affected". Alias Fleet's analysis points out that unauthorised access is confirmed, but no confirmed data theft and no misuse of the data has been reported. The company's later use of "compromised" for the 140,000 records suggests a firmer conclusion, but it has not said whether the data was copied off the server.
Why It Matters
The victims are easy to target. Migrant workers often depend on their employer and their work pass to stay in the country, and many have limited English. A FIN combined with date of birth, phone number and home address (often a dormitory) gives scammers what they need to pose as MOM, employers, clinics or remittance services. Fullerton Health itself says some affected people "may require additional support" to understand what happened.
Old data stayed on the server. About 43,000 records, nearly a third of the total, belonged to people whose passes had already lapsed. That is a data-retention failure. Under Singapore's PDPA, organisations must stop keeping personal data once they no longer need it for the purpose it was collected for. Expect the PDPC to look at this.
Third-party risk in government schemes. The PCP is a mandatory, government-run scheme delivered by private providers. Workers did not pick Fullerton Health in any real sense, but their data sat on its server. Anyone running outsourced public services should take note.
Part of a wider run of incidents. The Online Citizen counts this as one of at least seven data breaches disclosed in Singapore since late October, and Malay Mail also describes it as part of a broader pattern. Neither outlet suggests the incidents are linked.
The Attack Technique
Not disclosed. Fullerton Health has not said how the server was accessed, and no attacker, ransomware group or motive has been named. No group has publicly claimed the attack, and the company has not mentioned a ransom demand.
What is known:
- The target was a portal-facing server for PCP enrolment that the company calls "standalone". Its fix is to build "an entirely new server, with security measures in place from the outset" as a new PCP Enrolment Portal, and never reuse the old one.
- Plans to replace the server instead of patching it suggest the company does not trust the original build. That fits a server that was fully compromised or set up insecurely from the start, but the company has not confirmed either.
- An internet-facing enrolment portal holding a large set of identity records is a common target for web application attacks, stolen credentials and unpatched software. Without any detail from the company, none of these can be confirmed here.
What Organizations Should Do
- Purge records of people who have left. Delete or archive data for participants who are no longer eligible, such as people whose passes have expired, on a set schedule. Here that would have cut the exposure by about 43,000 records.
- Check what your monitoring actually covers. Make sure your managed security provider's scope includes every internet-facing portal, especially standalone systems built for a single contract or scheme. "No abnormalities in monitored assets" means little if the breached system was outside that scope.
- Harden enrolment and registration portals. Put them behind a web application firewall, require MFA for admin access, keep patching on a schedule, and test them regularly. Treat any portal that holds national ID numbers as a crown-jewel asset.
- Watch for bulk data access. Alert on large or unusual queries and exports from databases holding identity data, so a mass extraction is spotted within hours, not days.
- Notify vulnerable groups in their own languages. Send notices in the languages the affected people actually use, through channels they rely on, such as employers, dormitory operators and NGOs. Warn them specifically about scammers posing as MOM or healthcare providers.
- Shorten the gap between discovery and disclosure. Nine days passed between discovery and the first public notice, and the victim count came five days after that. Prepare notification templates and scoping steps in advance so affected people can be warned sooner.
Sources: Records of about 140,000 migrant workers exposed in Fullerton Healt... | Fullerton Health cybersecurity incident hits migrant worker data T... | Data Security Incident Affecting the Migrant Workers Primary Care P... | Fullerton Health server supporting migrant worker care programme hi... | Singapore migrant workers’ ID numbers, home addresses at risk after... | Fullerton Health hit by cyber attack, personal data of migrant work... | Fullerton Health server hit by cyber incident, migrant workers’ per... | Fullerton Health breach may have exposed workers' data