November 6, 2026: M1, the Singapore telecommunications operator, told customers that a data breach on 30 October 2026 leaked names, NRIC/FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses. It says payment cards, banking data and account access were not involved. The catalog entry records the notice; there is no published headcount.
What is known
- The breach date in the customer email is 30 October 2026. Notices went out on 6 November.
- M1 listed the fields above and said no payment-card details, financial or banking information, or customer account access had been compromised.
- Singapore's Personal Data Protection Commission is investigating. M1 apologised and asked customers to treat unsolicited calls, texts and mail with caution.
- The same day's news cycle also includes a separate Doctor Anywhere incident. The two are not described as one event.
What is not known
- How many customers are in the file, and whether post-paid, pre-paid and enterprise contacts are all in scope.
- How the actor got in, how long they had access, and whether a copy has been sold or posted.
- Whether M1 will mail a follow-up with a census or free monitoring.
NRIC/FIN plus date of birth and a home address is enough for SIM-swap social engineering and government-service impersonation even when the telco account itself was not opened.
Who is at risk
M1 customers whose records sat in the leaked set — at minimum anyone who received the 6 November email. Family members on the same billing account may be in the file even if they did not get a notice yet.
What to do
- Read the M1 email. Do not call back a number in a second message that claims to be "M1 security."
- Sign in to My M1 only by typing the official site or using the official app. Turn on extra login protection if it is offered.
- Put a port-out / SIM-swap lock on the line if M1 provides one, and treat unexpected OTP texts as a live attack.
- Watch Singpass, IRAS and bank mail that quotes your NRIC. Use the real apps, not links.
- If PDPC or M1 later publishes a headcount or a data-types update, keep that letter; it is the record you may need for a bank or police report.
Sources
Sourcing note: field lists come from the customer email as reported by CNA and The Straits Times. M1 had not posted a numbered census at indexing. We will update this post if it does.