M1 customer breach exposes identity and contact details; scope remains under investigation
M1 confirms it detected a breach on October 30 exposing names, NRIC/FIN numbers, dates of birth, mobile numbers, email addresses and addresses. M1 says payment-card data, financial or banking information, and account access were unaffected. Customer count and entry mechanism remain undisclosed; notifications and investigation continue.
- Disclosed
- Nov 6, 2026
- Updated Nov 7, 2026
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- M1 customers whose identity and contact details were involved; individual notices define exposure, not every subscriber.
- M1 · Data breach · Singapore
- In the wild
- Yes
- M1 confirms the breach in its November 6 public release.
What happened
L4 reflects confirmed personal-data exposure at a telecom provider, with scale unknown. M1’s public release corroborates the fields reported from customer notices. It identifies October 30 as the detection date and says services and operations continued throughout. Its assessment excludes payment-card data, financial or banking information and account access. M1 plans to notify affected customers by email or letter and says it is working with authorities and outside specialists. No CVE, software patch, compensation scheme or blanket password-reset order is established. This is separate from the Doctor Anywhere disclosure on the same day.
Crime-scene timeline
Oct 30, 2026
M1 detects the breach
Nov 6, 2026
M1 publicly acknowledges exposure and announces notifications
The public release confirms the six exposed fields, containment, uninterrupted operations and planned notices by email or letter. Neither the entry mechanism nor the start of unauthorized access is given.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- CNA independently reviewed customer emailConfirms the October 30 event and six identity/contact categories; M1 says payment-card data, banking information and account access were unaffected.
- AsiaOne independently reviewed a reader’s notificationSeparate customer email describes the same fields and exclusions; no published affected total.
- The Business Times company and regulator reportingReports containment, unaffected operations, planned email/letter notices and a PDPC investigation.
- M1 official breach releasePrimaryConfirms October 30 detection, affected fields, data exclusions, containment and planned notifications.