M1 says customer names, NRIC details and addresses were taken in an October 30 breach

Singapore telco M1 told the public on November 6, 2026 that it had suffered a data breach a week earlier, on October 30. The data taken includes names, identity card numbers, dates of birth, phone numbers, email addresses and home addresses. M1 hasn’t said how many customers are affected, and it has started emailing or writing to them. If you are or were an M1 customer, here is what is known.

What happened

According to The Straits Times and The Business Times, M1 said on Friday, November 6 that it had a data breach on October 30 and that the breach has since been contained. It said its services and business operations weren’t affected at any point. It said it has been working with the relevant authorities and third-party specialists on its investigations, and that it takes the security and confidentiality of the information entrusted to it very seriously.

M1 hasn’t said how the attacker got in, who it was, or whether the data was published or sold. It didn’t say how many customers are affected. AsiaOne reported that a customer whose details were involved got M1’s email at about 8 PM on November 6, and that the email apologises for the concern caused.

What data was involved

M1 lists:

• names
• NRIC or FIN numbers (Singapore’s national identity and foreigner identification numbers)
• dates of birth
• mobile phone numbers
• email addresses
• home addresses

M1 says no payment card details, financial or banking information, or customer account access were compromised.

What the regulator says

In a reply to the media on November 6, Singapore’s Personal Data Protection Commission (PDPC) said it is aware of the incident and is investigating, The Straits Times reported. The PDPC hasn’t said what it has found so far. AsiaOne also reported that Cyber Security Agency of Singapore chief executive Gwenda Fong urged businesses on Friday to review their cyber defences, and noted that a string of data breaches has been reported in Singapore recently.

Background

M1’s own security alerts page was updated on October 29, one day before the date it now gives for the breach, with a warning about scammers impersonating M1 staff. It said M1’s customer database "remains secure and was not the source of any information cited by the scammers", who sometimes cite victims’ names, NRIC numbers and contact details obtained "through other means". The two things haven’t been linked by M1 or by anyone else we have seen. We mention it only so readers can see what the company said before the breach was announced.

What this means for you

An NRIC number is a long-lived ID that can’t easily be swapped for a new one, and it appears with your name, birth date and phone number here. For a scammer, that’s enough to sound like a real call from a carrier, a bank or an official. That is the main risk to keep in mind: impersonation, rather than anyone being able to use your card or bank account directly, which M1 says were not exposed.

What you can do

1. Wait for M1’s message and check it’s real. M1 says it will contact affected customers by email or letter. Don’t click a link in a message about the breach. Go to M1’s app or website yourself.
2. Be wary of calls or messages that know your NRIC. Knowing it isn’t proof someone works for M1, your bank or the police. Hang up and call the official number. M1’s alerts page points to ScamShield at 1799 and the police hotline at 1800-255-0000 if you are in doubt.
3. Never give out banking details or passwords, or install apps from unofficial sources, on a call. M1 says it and government agencies will never ask for those things.
4. Check your accounts. Look at your phone bill and your bank for anything you don’t recognize.
5. Use a separate email address for each service if you can, so a message that claims to be from M1 but arrives at another address is easy to spot. See how scammers use leaked data.

How Frame helps

Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a leak at one company doesn’t reveal your main inbox. Frame never collects or stores the leaked records themselves.

Related coverage

• MoneySmart says an intruder copied customer data in Singapore and Hong Kong: another Singapore company that disclosed a breach this week, with contact details and policy numbers in the data.
• Singapore Airlines says about 46,000 bookings were reached in the Amadeus breach: the airline’s notice, which also covered travel documents for a small number of bookings.
• How scammers use leaked data to make phishing personal: how details like an ID number are used.

Sources

• The Straits Times, M1 hit by data breach, November 6, 2026
• The Business Times, M1 hit by data breach, November 6, 2026
• AsiaOne, Data of M1 customers compromised, including NRIC, phone numbers and addresses, November 6, 2026
• M1, Security Alerts (page updated October 29, 2026), accessed November 6, 2026