Meal ordering app Tappee suffers cyber breach, says SATS; four schools affected

SATS said the cybersecurity incident involved access by an unauthorised external party to Tappee, a school meal ordering app.

ST PHOTO: SHINTARO TAY

SATS said school meal app Tappee suffered a cyber breach through a platform weakness. Personal data such as student names, concession card numbers and some health details were exposed.

The app is used in four Singapore schools. SATS said no banking data, credit card details or student ID images were compromised, and its own IT systems were not affected.

SATS has stopped Tappee temporarily, notified authorities and is working with vendor Serial Multivision to fix security gaps. Meal ordering will continue through schools, with no impact on student meals.

SINGAPORE – An app for ordering school meals suffered a data breach, with personal information such as student s’ names, concession card numbers and financial assistance status compromised .

In a statement on Nov 10 , food solutions provider SATS said it identified a cybersecurity incident involving malicious access by an unauthorised external party to the app, called Tappee. It was launched in January 2023.

The app was developed and is maintained by a third-party technology vendor, Serial Multivision . The Tappee platform is currently implemented across four schools in Singapore, SATS said.

In a to The Straits Times’ queries, SATS declined to disclose the names of the four schools, citing the “privacy and interests of affected students and families” .

SATS’ statement did not say how many people were affected, and when it discovered the breach.

SATS said: “Unauthorised malicious access to this application was through a vulnerability in the Tappee platform which was detected by SATS’ cybersecurity monitoring capabilities.

“Upon detection of the incident, we immediately instructed Serial to suspend access to the Tappee application.”

Based on investigations to date, the types of information compromised include student names and e-mail addresses, student financial assistance status, student concession card numbers, as well as e-mail addresses of some parents and guardians , SATS said.

“A small number of records contain information on height and weight profile, allergy profile and caloric intake data,” SATS added.

No banking or credit card information, or details or images of student identification documents, have been compromised, as such information was not collected through the Tappee app , SATS said.

It added that its own IT infrastructure has not been compromised.

The company said its cybersecurity specialists are working closely with Serial to strengthen its security safeguards, address identified vulnerabilities in the Tappee platform and implement the necessary remediation measures arising from the investigation.

It said it has notified t he Personal Data Protection Commission (PDPC) and will cooperate fully with the relevant authorities as investigations continue.

As a precaution, Tappee will remain temporarily unavailable while security reviews and remediation works continue , SATS said. Tappee’s website could not be accessed when The Straits Times checked at 6.15pm on Nov 10.

Meal ordering and delivery services will continue without interruption , SATS added.

It said that meal orders are currently being managed directly through participating schools, and there has been no impact on meal provision to students .

SATS said that it recognises the concern this incident may cause affected students, parents and schools, and apologised.

It added that it has contacted the schools involved and are in the process of notifying affected individuals, while providing them with appropriate guidance and support.

The company said: “SATS is committed to supporting affected schools, students and their families and implementing further cybersecurity enhancements across systems operated by our third-party technology providers.”

The cybersecurity incident involving Tappee is among the latest in a string of high-profile data breaches in Singapore and abroad. Local organisations affected by data breaches recently include telco M1 , telemedicine provider Doctor Anywhere and media company SPH Media .

The Straits Times has contacted the Ministry of Education, the Cyber Security Agency of Singapore and the PDPC for more information.

Food and beverage sector

Education and schools

Personal Data Protection Act