Student Data Breached in SATS Tappee School Meal App Incident

An unauthorized external party accessed the Tappee meal ordering app, compromising the personal information of students at four schools in Singapore, The Straits Times reported.

Food solutions provider SATS identified the cybersecurity incident involving the platform, which was launched in January 2023. The company stated that the breach occurred through a vulnerability in the Tappee platform, which was detected via SATS’ own cybersecurity monitoring capabilities.

Upon discovering the unauthorized access, SATS immediately instructed the app’s developer, Serial Multivision, to suspend access to the Tappee application. The platform has since been taken offline while security reviews and remediation works continue.

The breach involved several types of sensitive data. According to a statement from SATS, the compromised information includes student names and email addresses, as well as student financial assistance status and concession card numbers.

SATS meal ordering app Tappee suffers cyber breach; four schools affected https://t.co/tK4K9XlUgk

— Post by @straits_times on X

The incident also affected some parents and guardians, whose email addresses were included in the compromised records. SATS noted that a small number of records contained more specific health-related data, specifically height and weight profiles, allergy profiles, and caloric intake data.

SATS clarified that no banking or credit card information was taken, nor were any images or details of student identification documents compromised. The company explained that this was because such information was not collected through the Tappee app.

SATS confirmed that its own information technology infrastructure remained uncompromised during the incident.

The Personal Data Protection Commission (PDPC) and the Cyber Security Agency of Singapore (CSA) both confirmed they were aware of the incident on November 10. The PDPC is currently investigating the matter, while the CSA has contacted SATS to offer assistance.

SATS declined to name the four specific schools affected, citing the “privacy and interests of affected students and families.” However, the company stated it has contacted the schools and is in the process of notifying the individuals involved to provide guidance and support.

Despite the digital disruption, meal services have not been interrupted. SATS reported that meal orders are currently being managed directly through the participating schools, ensuring no impact on meal provision to students.

Type of Data Compromised	Status
Student Names & Email Addresses	Compromised
Financial Assistance Status	Compromised
Concession Card Numbers	Compromised
Parent/Guardian Email Addresses	Compromised
Height, Weight, & Allergy Profiles	Small number of records compromised
Banking or Credit Card Info	Not compromised
Student ID Documents/Images	Not compromised

This incident follows a series of high-profile data breaches in Singapore. Recent local organizations affected by such breaches include the telecommunications company M1, the telemedicine provider Doctor Anywhere, and the media company SPH Media.

SATS expressed its commitment to supporting the affected families and implementing further cybersecurity enhancements across systems operated by its third-party technology providers. Cybersecurity specialists are currently working with Serial Multivision to address the identified vulnerabilities and implement remediation measures.

The Ministry of Education has been contacted for further information regarding the incident.