PUBLISHED ONNovember 11, 2026 9:35 AMBYLaili AbdeenFour schools have been affected by a cyber attack involving Tappee, a school meal ordering app used by students.
In a statement on Tuesday (Nov 10), food solutions provider SATS said it detected the "malicious access by an unauthorised external party" to Tappee and immediately instructed Serial Multivision Pte. Ltd, the third-party technology vendor that developed and maintains the platform, to suspend access.
The app is currently implemented across four schools in Singapore.
SATS said the hack happened through a vulnerability in the Tappee platform that was detected by its cybersecurity monitoring capabilities.
Based on investigations to date, the compromised data includes student names and email addresses, student financial assistance status, student concession card numbers and certain parent and guardian email addresses, according to SATS.
"A small number of records contain information on height and weight profile, allergy profile and caloric intake data," it added.
However, no banking or credit card information, or details or images of student identification documents, were compromised, as such information was not collected through the Tappee app.
SATS also said its own IT infrastructure was not compromised.
Its cybersecurity specialists are working closely with Serial to strengthen its security safeguards, address identified vulnerabilities in the Tappee platform and implement necessary remediation measures arising from the investigation.
SATS has also informed the Personal Data Protection Commission (PDPC) and said it will "cooperate fully" with the authorities as investigations continue.
In response to AsiaOne's queries, a PDPC spokesperson said the commission is aware of the incident and is investigating it.
As a precaution, Tappee will remain temporarily unavailable while security reviews and remediation works continue.
SATS assured users that meal ordering and delivery services could continue without interruption as it is currently being managed directly through participating schools, with no impact on meal provision to students.
"We recognise the concern this incident may cause affected students, parents and schools, and sincerely apologise," SATS said.
The company added that it has contacted the affected schools and is in the process of notifying affected individuals while providing them with appropriate guidance and support.
AsiaOne has reached out to PDPC and the Ministry of Education for more information.
This is also the fifth reported incident of a data breach in November, ranging from healthcare providers such as Fullerton Health and Doctor Anywhere to telcos like M1 and service provider Amadeus, which supports certain booking processes of Singapore Airlines.
[[nid:750418]]
