A data breach at Tappee, a meal-ordering app used by four schools in Singapore, exposed students’ names and the email addresses of some parents and guardians. Food provider SATS disclosed the breach on Tuesday (10 November 2026).
What Information Was Exposed
SATS said the compromised data also included students’ email addresses, concession card numbers and records of whether they received financial assistance. A small number of records included information about students’ allergies, height, weight and calorie intake.
The app did not collect bank or credit card information, or details or images of students’ identity documents, SATS said. The company said its own IT systems were unaffected.
SATS told CNA it was withholding the names of the four schools to protect the privacy of students and their families. Its 10 November statement did not give a figure for how many people were affected.
Schools Handle Meal Orders While Tappee Is Offline
SATS said its security monitoring picked up a weakness in Tappee that an outsider used to gain access. The company instructed Serial Multivision, the vendor that built and maintains the app, to suspend access. SATS is working with the vendor to fix the issue and will keep the app offline while security checks and repairs are underway.
The four schools are handling meal orders directly during the suspension. SATS said meal deliveries and service to students continued without interruption.
SATS apologised and said it had contacted the schools and was notifying affected individuals and offering them support. The company also notified the Personal Data Protection Commission, which told CNA it was investigating. The Straits Times reported that the Cyber Security Agency of Singapore had contacted SATS to offer assistance.
