M1 confirms contained Oct. 30 breach exposed customer identifiers

M1 said on Nov. 6, 2026 that it had identified a breach involving customer data and contained the incident. The company dated the intrusion to Oct. 30, 2026 in the customer e-mail, and no source has reported a broader timeframe for the access.

Names, mobile numbers, email addresses and residential addresses were among the information exposed, along with NRIC or FIN numbers and birth dates. According to M1, payment cards, financial and banking information, and access to customer accounts were not affected. The company has not disclosed how many customers were affected. It is unknown whether the exposed data left M1’s systems or was only accessed, as no source has stated which occurred.

NRIC and FIN numbers serve as national identifiers in Singapore for banking, telecommunications, government and commerce. An NRIC number is a Singapore identity card number, while a FIN number identifies a foreigner living in Singapore and serves as a national identifier for the same services. Combined with names, home addresses, e-mail addresses, phone numbers and birthdates, these identifiers can enable social engineering and phishing messages that imitate trusted brands.

Together, a name, home address, e-mail address, phone number and birthdate give an attacker enough detail to create a fake call, message or e-mail that seems genuine. An NRIC or FIN number paired with a date of birth and home address can support SIM-swap social engineering and impersonation of government services even if the telecom account was not breached. The NRIC number adds a document identifier that makes impersonation harder to detect.

The Personal Data Protection Commission said on Nov. 6, 2026 that it knows about the incident and is investigating it. The commission oversees personal data protection in Singapore. M1 said it is cooperating with relevant authorities and outside specialists on the investigation. At the time of writing, no source had reported enforcement action.

M1 said it will notify affected customers by email or a letter. M1 sent the disclosure to affected customers by email on Nov. 6, 2026, and no public notice page existed at the time. A separate breach by healthcare provider Doctor Anywhere was disclosed on Nov. 6, 2026, on the same day as the M1 disclosure, and is distinct from the M1 incident. The two incidents involved different organizations.

The company has not identified a threat actor, an attack method or any ransom demand. No source has reported confirmed misuse of the exposed data. M1 said its services and business operations stayed fully operational for the whole incident, and the company apologised to affected customers in an e-mail. “We regret that this data breach has occurred and apologise for the concern it has caused you,” M1 said.

M1 told customers to stay alert and to be cautious when responding to unexpected phone calls, texts or e-mails. The company also said customers should check contacts using official channels. Customers were advised by M1 to verify any message that claims to come from M1 by visiting the official website or opening the app, rather than clicking links in unexpected e-mails. Customers were urged by M1 to watch for callers or texts asking for OTP codes, passwords, payment details or NRIC confirmation.

Unusual activity in bank accounts, e-wallets and government portals should be checked by customers. Password practices on accounts tied to the same email address or phone number should be reviewed. Additional login protection should be enabled where available, and My M1 should be reached by typing the official website address or opening the official app.

A port-out or SIM-swap lock on the line can be requested from M1, and any unexpected OTP text should be treated as an active attack. Singpass, IRAS and bank correspondence that mentions their NRIC should be watched for, and official apps should be used instead of links.