Fullerton Health Group said unauthorised access to a standalone server supporting its Migrant Worker Primary Care Plan programme compromised about 140,000 work pass holder records, about 43,000 of them belonging to people whose passes are no longer valid, potentially exposing full names, foreign identification numbers, dates of birth, mobile numbers, email addresses and residential addresses, but no health, medical or financial information. The group, one of four anchor operators appointed by the Ministry of Manpower to run the plan, said it became aware of the incident on October 31, notified the ministry on November 2 and alerted the public on November 9; it isolated the server and is building an entirely new server to host a new enrolment portal, and its security provider’s preliminary investigation found no abnormalities across its other monitored systems. The ministry said it notified affected workers directly in their native languages through its FWMOMCare app and that access to care under the plan has not been disrupted, while the Cyber Security Agency said at least 12 cyber incidents involving Singapore organisations were reported between October 24 and November 13, six of them in healthcare and community care.
Fullerton Health breach exposes 140,000 migrant worker records
Fullerton Health said about 140,000 migrant worker records were compromised in a cyberattack on a server supporting Singapore's Migrant Worker Primary Care Plan, exposing names, identification numbers, birth dates, mobile numbers, email and home addresses, though no health or financial data.
Why it matters: Fullerton is one of four operators running mandatory primary care for Singapore's migrant workforce, and the breach lands in a wider surge: the Cyber Security Agency counted at least 12 reported cyber incidents in three weeks, six of them in healthcare, with monthly reports since September running at three times the pace of the first eight months of the year.
Data as of The Straits Times report of November 14, 2026, read in full via the estate browser route, reporting statements issued the same day by Fullerton Health Group and Singapore's Ministry of Manpower, a November 12 statement by the Ministry of Health, and figures from the Cyber Security Agency of Singapore. Single-outlet reporting of those official statements, with no independent second source in this pass, so the item ships at grade C. Developing item.
Sources
- 140,000 migrant worker records hit in Fullerton Health cyber breach; new server planned - The Straits Times - 2026-11-14