---
title: M1 (Singapore): customer names, NRIC/FIN, DOB, phones, emails and addresses exposed in an Oct 30 breach — now contained | ctxsec
url: https://ctxsec.com/items/m1-singapore-customer-pii-breach-contained-nov-6
description: "Singapore telco M1 disclosed on Nov 6 that it identified a data breach on Oct 30 involving certain customer information and that the breach has since been contained. Impacted fields named in the release: customer names, NRIC/FIN numbers, dates of birth, mobile numbers, email addresses and addresses. M1 says no payment card details, financial or banking information, or customer account access were compromised, and that all services stayed fully operational. Affected customers are being notified by email or letter. M1 says it is working with authorities and third-party specialists."
status: "official (M1 news release, Singapore, Nov 6); breach identified Oct 30 and contained; no payment/banking/account-access compromise claimed"
published: 2026-11-06
---

> Singapore telco M1 disclosed on Nov 6 that it identified a data breach on Oct 30 involving certain customer information and that the breach has since been contained. Impacted fields named in the release: customer names, NRIC/FIN numbers, dates of birth, mobile numbers, email addresses and addresses. M1 says no payment card details, financial or banking information, or customer account access were compromised, and that all services stayed fully operational. Affected customers are being notified by email or letter. M1 says it is working with authorities and third-party specialists.

[← Cybersecurity News](/news) · [markdown](/items/m1-singapore-customer-pii-breach-contained-nov-6.md)

official (M1 news release, Singapore, Nov 6); breach identified Oct 30 and contained; no payment/banking/account-access compromise claimed

2026-11-06

### M1 (Singapore): customer names, NRIC/FIN, DOB, phones, emails and addresses exposed in an Oct 30 breach — now contained

- **Customer action:** expect an official M1 email/letter; treat unexpected 'reset' or 'verify NRIC' messages as phishing until you confirm via M1's own channels.
- No account-access compromise is claimed — still rotate reused passwords and watch for SIM-swap / social-engineering follow-ons that abuse the leaked identity fields.
- Same-day Singapore disclosure wave also includes Doctor Anywhere / Adept Health (separate item).

Sources: [M1: Discloses Data Breach (Nov 6)](https://www.m1.com.sg/about-us/news-releases/2026/m1-discloses-data-breach) · [CNA: M1 and Doctor Anywhere hit by data breaches (Nov 6)](https://www.channelnewsasia.com/singapore/doctor-anywhere-data-breach-6530871)