Fullerton Health server breach exposes migrant workers' personal data (Singapore)
Severity: medium · Patch status: no-fix-needed · Since 2026-11-11
Fullerton Health disclosed that a server supporting its Migrant Worker Primary Care Plan (PCP) programme in Singapore was hit by a cybersecurity incident involving unauthorised access, apparently affecting migrant workers' personal data. The company announced the incident in a statement on its website on 9 November 2026. Details such as the number of affected individuals, the specific data fields exposed, attack vector, and whether data was exfiltrated have not been disclosed. No ransomware group or attacker has been named. As a data breach rather than a software flaw, no patch applies; remediation rests on containment, forensics, and notification obligations under Singapore's PDPA.
What to do
- If you are a Fullerton Health client or partner, request incident details and confirm whether your data or your employees' data (e.g. migrant workers under PCP) was affected
- Monitor for follow-up notifications from Fullerton Health and Singapore's PDPC
- For affected individuals, watch for phishing or misuse of exposed personal data and consider identity-monitoring precautions
- Review your own vendor risk assessments for healthcare data processors
Sources
All live incidents on Threat Watch
