M1 Data Breach Singapore: NRIC Numbers, Phone Numbers and Addresses Exposed — What M1 Customers Should Do
Image: Wikimedia Commons — M1 Limited logo (M1's current brand mark)
TL;DR — Singapore telco M1 says a data breach on 30 October exposed customer names, NRIC/FIN numbers, dates of birth, phone numbers, email addresses and home addresses. No payment card or banking details were compromised, the breach is contained, and M1 is notifying affected customers. M1 has not said how many customers were affected.
📌 KEY HIGHLIGHTS
- M1 disclosed on Friday 6 November 2026 that it suffered a data breach on 30 October 2026.
- Exposed data includes names, NRIC/FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses.
- No payment card details, financial or banking information, or customer account access were compromised.
- The breach has been contained and M1's services and business operations were unaffected throughout.
- M1 has not disclosed how many customers were affected; Singapore's Personal Data Protection Commission (PDPC) is investigating.
What happened?
Singapore telecommunications company M1 said on Friday 6 November that it had suffered a data breach on 30 October. Customers began receiving notification emails from the telco on Friday evening, and M1 confirmed the incident to Singapore media the same day.
M1 said the breach has since been contained. The telco's services and business operations were unaffected throughout the incident, and M1 said it has been working closely on the ongoing investigations with the relevant authorities and third-party specialists. M1 will alert affected customers via email or letter.
M1 is one of Singapore's three major telcos, alongside Singtel and StarHub. Founded in 1994, it is a subsidiary of Keppel. The company has not said how the attackers got in, or how many customers were affected.
What data was exposed in the M1 data breach?
M1 confirmed the following customer data was compromised in the 30 October breach:
| Data | Status |
|---|---|
| Names | Exposed |
| NRIC / FIN numbers | Exposed |
| Dates of birth | Exposed |
| Mobile numbers | Exposed |
| Email addresses | Exposed |
| Residential addresses | Exposed |
| Payment card details | Not compromised |
| Financial / banking information | Not compromised |
| Customer account access | Not compromised |
Illustrative image: data security. Image: Unsplash
Why it matters for Singapore readers
The exposure of NRIC numbers is what makes this breach serious. An NRIC number is a permanent national identity number — it cannot be swapped like a password. Combined with a name, date of birth, home address, mobile number and email address, it gives scammers almost everything they need to impersonate a victim convincingly, from phishing messages to fraudulent account applications.
That is also why M1 warned customers to verify the identity of anyone who contacts them through official channels. The exposed data is tailor-made for the follow-up scam: a call or message that already knows your full name, NRIC number and address is far more persuasive than a random one.
The timing adds to the concern. M1 is the second Singapore organisation to report a data breach on the same day: healthcare provider Doctor Anywhere disclosed on Friday evening that personal data of its users had leaked in a "malicious cyber incident", although it has not said how many users were affected or what data was taken. Earlier in the week, personal finance portal MoneySmart disclosed that hackers had breached its internal systems on 29 October. Singapore's Cyber Security Agency chief executive Gwenda Fong urged businesses on Friday to review their cyber defences.
Should you care?
✅ Yes, if you are an M1 customer — check your inbox for M1's notification email, and treat any unexpected call, text or email that quotes your personal details with suspicion. ⏳ If you are not an M1 customer, this is still a useful warning: the same identity details are the ones every service holds about you, so the precautions below apply generally.
What M1 customers should do now
- Look for M1's notification. M1 says it will alert affected customers via email or letter. If you receive it, your details were among those exposed.
- Do not trust unsolicited contact. If someone calls, texts or emails claiming to be from M1, your bank or a government agency — and quotes your NRIC number or address — verify them through official channels before sharing anything or following any link.
- Watch for phishing. Expect more convincing scam messages in the coming weeks. Be wary of messages urging urgent action, password resets or payments.
- Check your accounts. No account access was compromised, according to M1, but it is still worth reviewing recent activity on important accounts and enabling two-factor authentication where it is available.
- Report anything suspicious. Report scam calls and messages to the police so they can be tracked.
FAQs
Was my data exposed in the M1 data breach?
M1 has not published how many customers were affected. The telco says it is notifying affected customers directly by email or letter — if you receive that notification, your details were among those exposed.
Were my bank details or card numbers leaked?
No. M1 said no payment card details, financial or banking information, or customer account access were compromised in the breach.
Can I change my NRIC number?
An NRIC number is a permanent identity number, so it cannot simply be swapped like a password. That is why M1 customers should stay alert for identity-theft and phishing attempts that use the exposed details.
What is the regulator doing?
Singapore's Personal Data Protection Commission said on Friday that it is aware of the incident and is investigating the case. M1's services remain operational.
Takeaway: A major Singapore telco has confirmed that identity-grade customer data — including NRIC numbers — was exposed on 30 October. No money data was taken, but the exposed details are exactly what scammers need, so M1 customers should watch for M1's notification and treat unexpected contact with suspicion.
If you are an M1 customer, check your inbox for M1's notification email — and if a caller claims to be from M1 or your bank, hang up and call back on the official number.
Related reading: NTT Docomo outage in Japan: 5G service down nationwide, online shop suspended, DigiCert data breach confirmed: customer data and passports exposed, SMBC Consumer Finance data breach: 320,118 customers affected in Japan
Comments
Post a Comment