M1 says it suffered a data breach on 30 October 2026, exposing customer names, NRIC details and home addresses. The telco disclosed the incident on 6 November and says no payment card, banking or account log-in details were taken.
> Quick view: breach on 30 Oct 2026 · disclosed 6 Nov · names, NRIC details, birth dates, mobile numbers, emails and home addresses exposed · no card, banking or account access compromised · contained, services unaffected · affected customers to be told by email or letter · number affected not disclosed · report scams to 1799
What M1 has said
According to M1's statement as reported by The Straits Times on 6 November 2026:
- It suffered a data breach on 30 October 2026.
- The compromised data included customer names, identity card (NRIC) details, dates of birth, mobile numbers, email addresses and addresses.
- No payment card details, financial or banking information, or customer account access were compromised.
- The breach has been contained, and M1's services and business operations were unaffected throughout.
- It is working with the relevant authorities and third-party specialists on the ongoing investigation.
- It will alert affected customers by email or letter.
What is still unknown
M1 has not said how many customers are affected, how the breach happened, or whether former customers are included. The report we read does not mention compensation or free credit monitoring, so treat any message offering either as suspect until you have confirmed it with M1 yourself.
Why this one deserves extra care
Your name, NRIC details, birth date, mobile number and home address together are exactly what a scammer needs to sound like your telco, your bank or a government officer. A caller who reads out your real details proves nothing about who they are. It follows the MoneySmart and SIA's Amadeus booking records breaches disclosed earlier this month, so if you use more than one of these services, a scammer may be able to combine details.
What to do now
- Watch for M1's notice by email or letter. If it asks you to log in or verify anything, open the My M1+ app or type m1.com.sg yourself instead of tapping a link.
- Be wary of unexpected calls, SMS and emails, as M1 advises, especially ones that quote your personal details or claim a problem with your bill, SIM or line.
- Verify the caller through official channels. Hang up and call back on a number you look up yourself. Never share one-time passwords or banking log-ins, however much the caller knows about you.
- Verify police callers. From 2 November 2026, Singapore Police Force calls come from one number, 6000 0999, with a gov.sg SMS. Officials will never ask you over a call to transfer money.
- Add a scam filter such as the ScamShield app, or GovTech's Pango scam-alert app on Android.
- Report scams to the ScamShield Helpline at 1799. If you have already given out banking details, call your bank immediately and make a police report.
This is general safety information, not legal or financial advice. Confirm anything specific to your account with M1 directly.
