Finance comparison site data breach in Singapore: what does it mean for you?
An email about a data breach is the last thing anyone wants in their inbox. On 3 November, MoneySmart, a site for comparing financial products, sent one to some of its users in Singapore and Hong Kong. Someone had got into its internal systems on 29 October and copied some customers' personal data. It may include your name, NRIC number, mobile number and income range. So what can a stranger do with that, and what can you check this week? Here's what may have been taken, who's looking into it, and how to spot a scam that uses your details.
What may have been copied, and how will you know if it's yours?
The site is emailing affected customers directly, saying which of their data was involved and what steps they can take.
Its systems hold the details you share when you compare or apply for financial products there. Those include credit cards, personal loans and travel insurance. The table below lists what may have been reached, car insurance details included.
If you were there to compare loans, our personal loan calculator works out a loan's monthly instalment and total interest for you.
| Type | What it covers |
|---|---|
| Personal particulars | Name, date of birth, nationality, ID number |
| Contact details | Email address, mobile number, shipping address |
| Financial profile | Income range, life stage, products you already own |
| Vehicle and insurance | Vehicle details, car insurance inquiries or policies |
Can someone get into your accounts with your NRIC number?
Your NRIC number on its own isn't meant to be enough. It can show who you are, but it isn't supposed to prove you're you.
On 26 June 2025, PDPC and CSA told private firms to stop using NRIC numbers to prove who someone is. Other people may already know yours.
Their advisory also asks firms not to build passwords from part of your NRIC number and your date of birth. Dates of birth are on the list of what may have been taken, too.
What can a scammer do with your name and number?
Scammers may quote your name or NRIC number so that a call or message seems real. So don't trust a caller just because they have your details.
Banks will never send you a clickable link by SMS. Government officials will never ask you to transfer money over a phone call.
Other red flags are a link you didn't ask for and a web address with swapped or extra characters. So is a request for your OTP or banking details.
Our guide to Singapore's money dates lists the year's real CPF, tax and payout dates, so you know which letters to expect.
Who's looking into the breach?
PDPC is investigating, and MAS is following up closely with MoneySmart, the comparison site.
MAS has told the site to make sure the breach is contained and its IT systems are secure. MAS also wants a full root cause analysis and the right fixes put in place.
Regulators in Hong Kong have been alerted too. The site stopped the unauthorised access and has hired cybersecurity and digital forensics experts to look into it.
What can you check this week?
Here's what to do this week, in four steps.
Skip unexpected links
Never click links in emails or messages you didn't ask for.
Keep your codes private
Never share your OTPs, Singpass, CPF details or banking log-in.
Turn on 2FA
Set it up for your banking apps, social media and Singpass.
Check before you trust
Not sure about a call or message? Call the ScamShield Helpline at 1799.
Never click links in emails or messages you didn't ask for. Never share your OTPs, Singpass or CPF details, or banking log-in with anyone.
If a call or message seems off, call the 24/7 ScamShield Helpline at 1799 to check.
If you think you've already lost money, call your bank immediately and make a police report.
Once that's done, our financial health calculator scores your savings, debt and insurance cover in one check.
This week, set up 2FA for your banking apps, social media and Singpass accounts.
Frequently asked questions
How do I know if my data was in the breach?
The site is emailing affected customers directly. The email says which of your data was involved and what steps you can take.
Can I trust a caller who knows my NRIC number?
Scammers may quote your name or NRIC number to look real, so don't trust a caller just because they have your details. Government officials will never ask you to transfer money over a phone call.
Who is investigating the data breach?
PDPC is investigating. MAS has told the site to contain the breach, secure its IT systems and carry out a full root cause analysis.
Sources
- The Straits Times, personal finance platform data breach, 3 November 2026
- ScamShield, Government officials impersonation scams
- ScamShield, Phishing scams
- MDDI, Stopping the use of NRIC numbers as passwords in the private sector, 26 June 2025
Keep exploring
- Singapore Personal Finance Calendar 2026: Every Money Date That Matters
- Singapore retrenchments rose to 4,800 in Q3 2026: what does it mean for you?
- Singapore personal loan calculator
- Financial health check
This is general financial information for Singapore, not personal financial advice. Figures change, so verify current rates against the official sources above before acting. See our full disclaimer.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).