Meal ordering app Tappee suffers cyberbreach, says SATS; four schools affected
Sign up now: Get ST's newsletters delivered to your inbox
SATS said the cybersecurity incident involved access by an unauthorised external party to Tappee, a school-meal ordering app.
ST PHOTO: SHINTARO TAY
- SATS said school meal app Tappee suffered a cyber breach through a platform weakness. Personal data such as student names, concession card numbers and some health details were exposed.
- The app is used in four Singapore schools. SATS said no banking data, credit card details or student ID images were compromised, and its own IT systems were not affected.
- SATS has stopped Tappee temporarily, notified authorities and is working with vendor Serial Multivision to fix security gaps. Meal ordering will continue through schools, with no impact on student meals.
AI generated
SINGAPORE – An app for ordering school meals suffered a data breach, with personal information such as students’ names, concession card numbers and financial assistance status compromised.
In a statement on Nov 10, food solutions provider SATS said it identified a cybersecurity incident involving malicious access by an unauthorised external party to the app, called Tappee. It was launched in January 2023.
The app was developed and is maintained by a third-party technology vendor, Serial Multivision. The Tappee platform is currently implemented across four schools in Singapore, SATS said.
In a reply to The Straits Times’ queries, SATS declined to disclose the names of the four schools, citing the “privacy and interests of affected students and families”.
The Ministry of Education later said, in response to media queries, that the schools using the Tappee application for SATS school meal ordering are: Yusof Ishak Secondary School, Northshore Primary School, and Hwa Chong Institution, which comprises its high school and junior college sections.
In its statement on Nov 14, the ministry said the schools are working closely with SATS to ensure that meal provisions are not affected, and to provide guidance and support to those affected by the breach.
SATS’ statement did not say how many people were affected and when it discovered the breach.
SATS said: “Unauthorised malicious access to this application was through a vulnerability in the Tappee platform which was detected by SATS’ cybersecurity monitoring capabilities.
“Upon detection of the incident, we immediately instructed Serial to suspend access to the Tappee application.”
Based on investigations to date, the types of information compromised include student names and e-mail addresses, student financial assistance status and student concession card numbers, as well as e-mail addresses of some parents and guardians, SATS said.
“A small number of records contain information on height and weight profile, allergy profile and caloric intake data,” SATS added.
No banking details, credit card information or images of student identification documents have been compromised, as such information was not collected through the Tappee app, SATS said.
It added that its own information technology infrastructure has not been compromised.
The company said its cybersecurity specialists are working closely with Serial to strengthen its security safeguards, address identified vulnerabilities in the Tappee platform and implement the necessary remediation measures arising from the investigation.
It said it notified the Personal Data Protection Commission (PDPC) on Nov 10 and will cooperate fully with the authorities as investigations continue.
PDPC and the Cyber Security Agency of Singapore (CSA) said in separate media replies on Nov 10 that they were aware of the incident. PDPC added that it is investigating the incident, while CSA said it has contacted SATS to offer assistance.
As a precaution, Tappee will remain temporarily unavailable while security reviews and remediation works continue, SATS said in its media statement. Tappee’s website could not be accessed when ST checked at about 6.15pm on Nov 10.
Meal ordering and delivery services will continue without interruption, SATS added.
It said meal orders are currently being managed directly through participating schools and there has been no impact on meal provision to students.
SATS said it recognises the concern this incident may cause affected students, parents and schools and apologised.
It added that it has contacted the schools involved and is in the process of notifying affected individuals, while providing them with appropriate guidance and support.
The company said: “SATS is committed to supporting affected schools, students and their families and implementing further cybersecurity enhancements across systems operated by our third-party technology providers.”
The cybersecurity incident involving Tappee is among the latest in a string of high-profile data breaches in Singapore and abroad. Local organisations affected by data breaches recently include telco M1, telemedicine provider Doctor Anywhere and media company SPH Media.