Education
School meal ordering app Tappee hit by cybersecurity incident, says SATS; four schools affected
Key Points
School meal ordering app Tappee hit by cybersecurity incident, says SATS; four schools affected "No banking or credit card information, or details or images of student identification documents, have been compromised, as such information was not collected through the Tappee application," said food solutions provider SATS. Tappee, a school meal ordering application that is currently used in four schools in Singapore, has been hit by a cybersecurity incident, said food solutions provider SATS...
School meal ordering app Tappee hit by cybersecurity incident, says SATS; four schools affected
"No banking or credit card information, or details or images of student identification documents, have been compromised, as such information was not collected through the Tappee application," said food solutions provider SATS.
SINGAPORE: Tappee, a school meal ordering application that is currently used in four schools in Singapore, has been hit by a cybersecurity incident, said food solutions provider SATS on Tuesday (Nov 10).
SATS, which identified the incident, said it involved "malicious access by an unauthorised external party" to Tappee.
Based on investigations so far, the types of data compromised include student names, email addresses, financial assistance statuses, student concession card numbers and certain parent and guardian email addresses, said SATS.
A small number of records also contained students' height, weight, allergy profiles and caloric intake data.
"No banking or credit card information, or details or images of student identification documents, have been compromised, as such information was not collected through the Tappee application."
Tappee will be temporarily unavailable as a precautionary measure as security reviews and remediation works are ongoing, said SATS, adding that school meal provision has not been affected.
In response to CNA's query, SATS said it is not naming the four schools "to protect the privacy and interests of affected students and families".
"SATS promptly activated its business continuity arrangements to ensure that meal ordering and delivery services continue without interruption. Meal orders are currently being managed directly through participating schools, and there has been no impact on meal provision to students."
SATS found that the unauthorised malicious access was through a vulnerability in the Tappee platform, which is developed and maintained by a third-party technology vendor, Serial Multivision.
"Upon detection of the incident, we immediately instructed Serial to suspend access to the Tappee application. SATS confirms that our own IT infrastructure has not been compromised."
SATS said that its cybersecurity specialists are working closely with Serial to strengthen security safeguards, address the vulnerabilities in the Tappee platform and take the necessary measures to resolve the issue.
It added that it has notified the Personal Data Protection Commission (PDPC) and will cooperate fully in investigations.
"We recognise the concern this incident may cause affected students, parents and schools, and sincerely apologise," said SATS.
"We have contacted the schools involved and are in the process of notifying affected individuals, while providing them with appropriate guidance and support."
In a statement, PDPC told CNA it is aware of the incident and is investigating.