# Tappee School Meal App Suffers Cybersecurity Breach Unauthorized access to Tappee platform exposes student data across four Singaporean schools. - **Source:** [CNA – Singapore](https://www.channelnewsasia.com/singapore) - **Published:** 2026-11-10 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/d90067ea-be5a-4d0b-ad73-fafe532ded68 ## Unauthorized Platform Access Food solutions provider SATS reported a cybersecurity incident involving the Tappee school meal ordering application. An unauthorized external party gained malicious access to the platform, which is developed by a third-party vendor, Serial Multivision. SATS confirmed that its own internal IT infrastructure remains secure and was not compromised during the breach. ## Compromised Student Data Investigations revealed that student names, email addresses, financial assistance statuses, and concession card numbers were exposed. Additionally, some records contained sensitive health information, including student height, weight, allergy profiles, and caloric intake data. SATS clarified that no banking, credit card, or student identification document images were collected or compromised. ## Scope of Impact The incident currently affects four schools in Singapore. To protect the privacy and interests of the students and their families, SATS has decided not to disclose the names of the specific institutions involved. The company is actively contacting the affected individuals to provide necessary guidance and support regarding the data exposure. ## Operational Continuity Measures Despite the application being temporarily unavailable for security reviews, SATS stated that school meal provision remains unaffected. The company activated business continuity arrangements immediately following the detection of the breach. Currently, meal orders are being managed directly through the participating schools to ensure that service delivery continues without any further interruption. ## Vendor Responsibility and Remediation The vulnerability was identified within the Tappee platform, which is maintained by the technology vendor Serial Multivision. Upon discovering the unauthorized access, SATS instructed the vendor to suspend the application. Cybersecurity specialists from SATS are now working closely with Serial Multivision to address platform vulnerabilities and strengthen existing security safeguards. ## Regulatory Involvement SATS has officially notified the Personal Data Protection Commission (PDPC) regarding the security incident. The PDPC confirmed it is aware of the situation and has launched an investigation into the matter. SATS stated it will cooperate fully with the commission throughout the investigation process to ensure all regulatory requirements are met. ## Data Privacy Context The exposure of health-related data, such as allergy profiles and caloric intake, presents specific privacy concerns for the affected families. While financial data was not stored, the inclusion of personal identifiers and health metrics necessitates rigorous remediation. The company has issued a formal apology to the students, parents, and schools involved. ## Future Security Outlook This incident highlights the risks associated with third-party software dependencies in school infrastructure. Moving forward, the focus remains on completing remediation works and restoring the Tappee platform securely. Stakeholders should monitor for further updates as the PDPC investigation progresses and SATS implements enhanced security protocols to prevent future unauthorized access. ## Sources covering this story - https://www.channelnewsasia.com/singapore/school-meal-ordering-app-tappee-sats-data-breach-cybersecurity-6539236 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._