The cybersecurity incident occurred when an unauthorized external party exploited a vulnerability in the third-party application, which was identified via internal monitoring systems. Exposed information encompassed student names, financial assistance records, concession card numbers, and parent emails, along with a limited subset of biometric and dietary profiles. SATS verified that its internal IT infrastructure remained secure and that no financial data was leaked because the software never collected payment details. Meal ordering operations are currently proceeding manually through the individual schools while the platform's digital services stay offline.
Key points
The breach was confined to the third-party platform and did not compromise SATS' central…: The breach was confined to the third-party platform and did not compromise SATS' central IT infrastructure.
School meal deliveries are continuing without disruption through direct coordination by t…: School meal deliveries are continuing without disruption through direct coordination by the participating schools.
No payment card numbers, banking information, or identification document images were stor…: No payment card numbers, banking information, or identification document images were stored or exposed during the incident.
Sources checked by our analysis pipeline: 1
- SATS said its school meal app Tappee suffered a cyber breach through a vulnerability, affecting four Singapore schools and exposing student and parent data.
- Compromised details include names, e-mail addresses, concession card numbers, financial assistance status, and some allergy, height, weight and caloric intake records.
- SATS has suspended Tappee, notified the authorities, and said meal ordering and delivery will continue while it fixes the security flaws.
AI generated
SINGAPORE – An app for ordering school meals suffered a data breach, with personal information such as students’ names, concession card numbers and financial assistance status compromised.
In a statement on Nov 10, food solutions provider SATS said it identified a cybersecurity incident involving malicious access by an unauthorised external party to the app, called Tappee.
The app was developed and is maintained by a third-party technology vendor, Serial Multivision. The Tappee platform is currently implemented across four schools in Singapore, SATS said, without specifying the four schools.
SATS did not say how many people were affected, and when it discovered the breach.
Investigators believe a single threat actor orchestrated the coordinated intrusion across five systems, exposing non-financial personal records belonging to roughly 9 percent of the publisher's database. Outside cybersecurity specialists were engaged to contain the breach, while regulatory and law enforcement bodies across Singapore received formal incident reports. This security failure contributes to a troubling surge of high-profile digital attacks targeting major corporate networks throughout the country.
Global transit leaders gathered to examine emerging technologies aimed at modernizing urban commutes and addressing infrastructure constraints. The event emphasized contactless station access, artificial intelligence for emergency vehicle navigation, and space-saving safety retrofits for rail networks. These developments signal a concerted push toward automated, high-efficiency transit systems across major metropolitan hubs.
Unauthorized external actors exploited a platform vulnerability in a third-party vendor system, exposing personal and dietary records belonging to students and their guardians across Singapore. SATS confirmed its own corporate IT infrastructure remained secure while the meal ordering tool was suspended for remediation. The incident has been escalated to data privacy regulators as alternative school-managed distribution protocols keep daily food deliveries running.