Technology1 min read

School meal ordering app Tappee hit by cybersecurity incident, says SATS; four schools affected

By · Published by Everything Blog

In short

SATS announced that an external vulnerability in the third-party application maintained by Serial Multivision enabled unauthorized access to student and guardian data across four unnamed schools. Compromised records include student names, financial assistance records, emails, concession card details, and a small number of physical health profiles. SATS has reported the breach to the Personal Data Protection Commission, which has opened an active regulatory investigation into the matter. To safeguard day-to-day operations, the vendor suspended the application and instituted direct manual ordering through the schools to avoid lunch service interruptions.

Key points

  • The Personal Data Protection Commission was formally notified and is currently investigat…: The Personal Data Protection Commission was formally notified and is currently investigating the third-party platform breach.
  • SATS enacted business continuity protocols directly with affected institutions to ensure…: SATS enacted business continuity protocols directly with affected institutions to ensure student meal orders proceed without interruption.
  • Application access remains suspended while SATS and its technology vendor conduct necessa…: Application access remains suspended while SATS and its technology vendor conduct necessary security remediations and review protocols.

Sources checked by our analysis pipeline: 1

"No banking or credit card information, or details or images of student identification documents, have been compromised, as such information was not collected through the Tappee application," said food solutions provider SATS.

SINGAPORE: Tappee, a school meal ordering application that is currently used in four schools in Singapore, has been hit by a cybersecurity incident, said food solutions provider SATS on Tuesday (Nov 10).

SATS, which identified the incident, said it involved "malicious access by an unauthorised external party" to Tappee.

Based on investigations so far, the types of data compromised include student names, email addresses, financial assistance statuses, student concession card numbers and certain parent and guardian email addresses, said SATS.

A small number of records also contained students' height, weight, allergy profiles and caloric intake data.

"No banking or credit card information, or details or images of student identification documents, have been compromised, as such information was not collected through the Tappee application."

Tappee will be temporarily unavailable as a precautionary measure as security reviews and remediation works are ongoing, said SATS, adding that school meal provision has…

Technology