Singapore telecommunications provider M1 has disclosed a data breach that exposed the personal identification details of its customers, including their national identity numbers. The company identified the breach on 30 October 2026 and disclosed it publicly on 6 November, and Singapore's data protection regulator has confirmed it is investigating.

M1, one of Singapore's four major mobile and broadband operators, said in its official statement that the breach has since been contained. The company said it is working closely with the relevant authorities and third-party specialists on the ongoing investigation, and that all of its services and business operations remained fully operational throughout the incident.

What data was exposed

The information affected includes customer names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses. NRIC numbers are Singapore's national identity card numbers, and FIN numbers are the equivalent identifiers issued to foreign residents, which makes them sensitive personal data that can be used in identity theft.

M1 stressed what was not affected. No payment card details, financial or banking information, or customer account access were compromised, according to the company. That distinction matters for customers: the breach exposed identity and contact details, but the company says attackers did not reach the systems that hold money or account credentials.

M1 has not disclosed how many customers were affected. The company said it will start communicating with affected customers, who will be notified by email or letter. Customers who have not heard from the company have not been told whether their records were involved, which leaves the scale of the breach unclear for now.

Regulator investigating

Singapore's Personal Data Protection Commission said on 6 November that it was aware of M1's breach and was investigating, TelecomDrive reported, citing coverage in The Straits Times carried by The Business Times. The investigation will examine whether the telecom met its obligations under Singapore's Personal Data Protection Act, and penalties could follow if negligence is established.

The M1 disclosure came on the same day as a separate breach reported by telemedicine provider Doctor Anywhere, which described its own incident as a malicious cyber incident involving unauthorised access by an unknown third party. The two incidents appear unrelated, but together they made 6 November a difficult day for Singapore's data protection record, coming after other recent breaches at financial comparison platform MoneySmart and the Singapore Land Authority.

What M1 customers should do

M1 urged customers to remain vigilant and exercise caution when receiving unsolicited calls, messages or emails. That warning reflects the most likely risk from this kind of breach: criminals using the exposed names, identity numbers and contact details to impersonate the company, banks or government agencies in phishing and fraud attempts.

Customers should treat unexpected calls or messages claiming to be from M1, a bank or a government agency with suspicion, and should not share passwords, one-time passcodes or banking details in response to them. Anyone contacted by M1 about the breach should expect to hear by email or letter, as the company described, rather than through a phone call asking for sensitive information.

The breach also renews scrutiny of how Singapore's critical infrastructure operators protect citizen data. M1 has released minimal technical detail about how the attackers gained access, and the company has not said who was behind the incident. Until the investigation reports, the confirmed facts are the dates, the data involved, and the regulator's involvement, and customers are left to watch for misuse of the personal details that were exposed.