Breach · 4 min read
MoneySmart says an intruder copied customer data in Singapore and Hong Kong
The finance comparison site says names and emails were copied, plus shipping addresses and application or policy numbers for people who claimed rewards. It hasn’t said how many.
MoneySmart is a website where people in Singapore and Hong Kong compare and apply for credit cards, loans and insurance, often with a cash or gift reward for signing up through it. On November 3, 2026, it started emailing customers to say that someone had got into its internal IT systems and copied some of their personal data. If you’ve used MoneySmart to compare or apply for a financial product, here’s what the company has said and what to watch for.
What happened
MoneySmart says it discovered on October 29 that an unauthorized third party had accessed some of its internal IT systems. Its investigation confirmed that some customer data had been copied and that customers in both Singapore and Hong Kong were affected. Chief executive Vinod Nair said in a note on the company’s website that MoneySmart stopped the access and secured its systems soon after discovering it, and has brought in independent cybersecurity and forensics experts. “I am deeply sorry to everyone affected,” he wrote. “Customers trust us with information about their financial lives, and we take that responsibility very seriously.”
MoneySmart hasn’t said how the intruder got in, how long they had access or how many customers are affected. When CNA asked for the number, the company sent back the same statement it had posted online. The service is running as normal.
What was copied
In emails to customers seen by CNA and The Business Times, MoneySmart says the affected systems hold the personal data customers share when they compare or apply for financial products, such as:
- name
- email address
People who submitted a reward claim may also have had these copied:
- the shipping address for the reward
- the application or policy reference number for the product they claimed it on
Two readers who got the email told AsiaOne that their mobile numbers were listed too. What’s included seems to vary by person, so the email you receive is the best guide to your own case. None of the reports mention card numbers, bank account numbers or passwords, and MoneySmart hasn’t said either way, though it does suggest checking your card statements as a precaution.
What regulators have been told
MoneySmart says it has reported the breach to Singapore’s Personal Data Protection Commission (PDPC) and the Monetary Authority of Singapore, and in Hong Kong to the Office of the Privacy Commissioner for Personal Data and the Insurance Authority, The Business Times reports. A PDPC spokesperson told CNA that the commission is aware of the case and is investigating. MoneySmart says it has tightened access controls and monitoring and set up a team to support affected customers.
What this means for you
A name and email address can’t get anyone into your accounts on their own. What makes this breach useful to scammers is the context. Whoever has the data knows you were shopping for a card, loan or policy, and for reward claimants, which product you signed up for, its reference number and where your gift is being sent. That’s the raw material for convincing messages: a “reward delivery” that needs a small fee, a “problem with your application” that needs you to log in, or a call from someone claiming to be your bank or insurer. One AsiaOne reader said she noticed more phishing messages in the days before the news.
What you can do
- Read MoneySmart’s email to see which details it lists for you.
- Be wary of delivery or reward messages that ask you to confirm details or pay a fee. MoneySmart itself warns about these. If you’re waiting on a reward, check its status by signing in to MoneySmart directly.
- Never share passwords or one-time passwords (OTPs) with anyone who contacts you, even if they quote your real application or policy number.
- Check your card and bank statements and report anything you don’t recognize to your bank promptly, as MoneySmart recommends.
- Contact your bank or insurer through the number on its own website or card if a message about your application worries you.
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases let you give each comparison site or sign-up its own address, so a leak at one doesn’t reach your main inbox. Frame never collects or stores the leaked records themselves.
Sources
- CNA, Financial services firm MoneySmart hit by IT security breach, some customers’ data copied, November 3, 2026
- The Business Times, MoneySmart hit by data breach; Singapore, Hong Kong customers affected, November 3, 2026
- AsiaOne, “I am deeply sorry”: MoneySmart CEO apologises after data breach; affected customers speak out, November 3, 2026
More stories
- BreachMarathon Health says a caller posing as IT got in, in a breach reported at about 5.7 million people · 5 min read
- BreachSingapore Airlines says about 46,000 bookings were reached in the Amadeus breach · 5 min read
- BreachWorkOS says an AI-assisted attack reached its sales tool, with customer contacts and Slack excerpts · 5 min read
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.