{
  "id": "m1-customer-data",
  "url": "https://ohshit.app/incidents/m1-customer-data/",
  "title": "M1 customer breach exposes identity and contact details; scope remains under investigation",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-06",
  "date_is_approximate": false,
  "updated": "2026-11-07",
  "tags": [
    "M1",
    "Data breach",
    "Singapore"
  ],
  "ecosystems": [],
  "summary": "M1 confirms it detected a breach on October 30 exposing names, NRIC/FIN numbers, dates of birth, mobile numbers, email addresses and addresses. M1 says payment-card data, financial or banking information, and account access were unaffected. Customer count and entry mechanism remain undisclosed; notifications and investigation continue.",
  "splash": "M1 customers whose identity and contact details were involved; individual notices define exposure, not every subscriber.",
  "wipe": "Verify your notice through M1, guard against targeted impersonation and check unexpected account or banking activity.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Confirm the specific information involved",
      "hint": "Open the known M1 website or app directly and use its established support channel. Retain your notice and ask about your records; do not infer every customer or every field was affected."
    },
    {
      "title": "Verify unsolicited contacts independently",
      "hint": "Names, identity details and addresses can make telco, bank or government impersonation convincing. Do not disclose passwords, one-time codes or banking credentials through a message or caller. Verify account-change requests in the real app and report suspected misuse through your bank or M1."
    }
  ],
  "sources": [
    {
      "name": "CNA independently reviewed customer email",
      "url": "https://www.channelnewsasia.com/singapore/doctor-anywhere-data-breach-6530871",
      "says": "Confirms the October 30 event and six identity/contact categories; M1 says payment-card data, banking information and account access were unaffected.",
      "primary": false
    },
    {
      "name": "AsiaOne independently reviewed a reader’s notification",
      "url": "https://www.asiaone.com/singapore/m1-data-breach",
      "says": "Separate customer email describes the same fields and exclusions; no published affected total.",
      "primary": false
    },
    {
      "name": "The Business Times company and regulator reporting",
      "url": "https://www.businesstimes.com.sg/companies-markets/telcos-media-tech/m1-hit-data-breach",
      "says": "Reports containment, unaffected operations, planned email/letter notices and a PDPC investigation.",
      "primary": false
    },
    {
      "name": "M1 official breach release",
      "url": "https://www.m1.com.sg/about-us/news-releases/2026/m1-discloses-data-breach",
      "says": "Confirms October 30 detection, affected fields, data exclusions, containment and planned notifications.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "M1 confirms the breach in its November 6 public release.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 30, 2026",
      "title": "M1 detects the breach"
    },
    {
      "date": "Nov 6, 2026",
      "title": "M1 publicly acknowledges exposure and announces notifications",
      "body": "The public release confirms the six exposed fields, containment, uninterrupted operations and planned notices by email or letter. Neither the entry mechanism nor the start of unauthorized access is given."
    }
  ],
  "body_markdown": "L4 reflects confirmed personal-data exposure at a telecom provider, with scale unknown. M1’s public release corroborates the fields reported from customer notices. It identifies October 30 as the detection date and says services and operations continued throughout. Its assessment excludes payment-card data, financial or banking information and account access. M1 plans to notify affected customers by email or letter and says it is working with authorities and outside specialists. No CVE, software patch, compensation scheme or blanket password-reset order is established. This is separate from the Doctor Anywhere disclosure on the same day."
}