Meal ordering app Tappee suffers cyber breach, says SATS; four schools affected

SINGAPORE – An app for ordering school meals suffered a data breach, with personal information such as students’ names, concession card numbers and financial assistance status compromised.

In a statement on Nov 10, food solutions provider SATS said it identified a cybersecurity incident involving malicious access by an unauthorised external party to the app, called Tappee.

The app was developed and is maintained by a third-party technology vendor, Serial Multivision. The Tappee platform is currently implemented across four schools in Singapore, SATS said, without specifying the four schools.

SATS did not say how many people were affected, and when it discovered the breach.

SATS said: “Unauthorised malicious access to this application was through a vulnerability in the Tappee platform which was detected by SATS’ cybersecurity monitoring capabilities.

“Upon detection of the incident, we immediately instructed Serial to suspend access to the Tappee application.”

Based on investigations to date, the types of information compromised include student names and e-mail addresses, student financial assistance status, student concession card numbers, as well as e-mail addresses of some parents and guardians, SATS said.

“A small number of records contain information on height and weight profile, allergy profile and caloric intake data,” SATS added.

No banking or credit card information, or details or images of student identification documents, have been compromised, as such information was not collected through the Tappee app, SATS said.

It added that its own IT infrastructure has not been compromised.

The company said its cybersecurity specialists are working closely with Serial to strengthen its security safeguards, address identified vulnerabilities in the Tappee platform and implement the necessary remediation measures arising from the investigation.

It said it has notified the Personal Data Protection Commission and will cooperate fully with the relevant authorities as investigations continue.

As a precaution, Tappee will remain temporarily unavailable while security reviews and remediation works continue, SATS said.

Meal ordering and delivery services will continue without interruption, SATS added.

It said that meal orders are currently being managed directly through participating schools, and there has been no impact on meal provision to students.

SATS said that it recognises the concern this incident may cause affected students, parents and schools, and apologised.

It added that it has contacted the schools involved and are in the process of notifying affected individuals, while providing them with appropriate guidance and support.

The company said: “SATS is committed to supporting affected schools, students and their families and implementing further cybersecurity enhancements across systems operated by our third-party technology providers.”

The cybersecurity incident involving SATS is among the latest in a string of high-profile data breaches in Singapore and abroad.

Daniel Lai is a journalist at the ST Now team, covering breaking news and international affairs.