Cyberattack on Singapore school meal app exposes children’s personal data across four schools

Singapore food solutions provider SATS said a vulnerability in its Tappee school meal-ordering platform allowed unauthorised access to students’ personal data. — SATS pic

By Malay Mail

First Published: Wednesday, 11 Nov 2026 12:06 PM MYT

SINGAPORE, Nov 11 — A cyberattack on a school meal-ordering app used by four Singapore schools has exposed students’ personal information, including financial assistance status and, in some cases, sensitive health data such as allergies, height and weight.

Food solutions provider SATS confirmed yesterday that its Tappee application had been compromised after an unauthorised external party exploited a security vulnerability in the platform, Singapore-based media organisation CNA reported.

The compromised data included student names, email addresses, concession card numbers and financial assistance statuses, alongside some parents’ and guardians’ email addresses.

A small number of records also contained students’ allergy profiles, height, weight and caloric intake information.

SATS declined to identify the four schools involved, telling CNA it was withholding their names “to protect the privacy and interests of affected students and families”.

The company said no banking or credit card information had been compromised, nor had any student identification documents or images, as the application did not collect such information.

The breach was traced to a vulnerability in Tappee, which was developed and maintained by third-party technology vendor Serial Multivision.

“Upon detection of the incident, we immediately instructed Serial to suspend access to the Tappee application. SATS confirms that our own IT infrastructure has not been compromised,” SATS said.

The app has been temporarily suspended while security reviews and remedial work are carried out.

However, SATS said school meal services had not been disrupted, with orders now being handled directly through participating schools.

The company is working with Serial to address the vulnerability and strengthen security safeguards.

Singapore’s Personal Data Protection Commission (PDPC) confirmed to CNA that it was investigating the incident.

SATS said it had contacted the affected schools and was notifying individuals whose information had been compromised.

“We recognise the concern this incident may cause affected students, parents and schools, and sincerely apologise,” the company said.

The number of students affected has not been disclosed, leaving the full scale of the breach unclear.