Cyberattack on Singapore school meal app exposes children’s personal data across four schools
SINGAPORE, Nov 11 — A cyberattack on a school meal-ordering app used by four Singapore schools has exposed student...
A cyberattack compromised a school meal-ordering app used by four Singapore schools, exposing students' personal information including financial assistance status and sensitive health data on November 11. The breach occurred due to an unauthorised external party exploiting a security vulnerability in the platform, Tappee, developed by third-party technology vendor Serial Multivision.
Data leaked included student names, email addresses, concession card numbers, financial assistance statuses, along with some parents' and guardians' email addresses. A small number of records also contained students' allergy profiles, height, weight, and caloric intake information. SATS, the food solutions provider behind the app, declined to identify the four schools involved, citing privacy concerns.
The breach did not compromise banking or credit card information, nor any student identification documents or images. SATS immediately suspended the app and instructed Serial to halt access to Tappee. The company's IT infrastructure remained intact. School meal services continued, with orders now handled directly through participating schools.
SATS is collaborating with Serial to address the vulnerability and enhance security measures. The Personal Data Protection Commission (PDPC) in Singapore is investigating the incident. SATS has notified affected individuals and apologised for the concern caused. The number of students impacted remains undisclosed.
Written by urgent.news from Malay Mail's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
