Short answer
SIMBA Telecom said on 25 September 2026 that a breach discovered the day before exposed the personal details of 23,549 customers. It says no credit card or bank account data was involved and that it has no sign of misuse. Singapore's PDPC is investigating.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | SIMBA Telecom |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Telecommunications |
| Country | Singapore |
| Detected | 2026-09-24 |
| Disclosed | 2026-09-25 |
| People or records affected | 23,549 customers who had registered for SIMBA's services |
What data was exposed
- Names
- Identity card numbers
- Dates of birth
- Mobile numbers
- Email addresses
What happened
SIMBA Telecom, a Singapore mobile operator, discovered a data breach on 24 September 2026 and published a notice the next day, The Star reports. The personal details of 23,549 customers who had registered for its services were exposed. SIMBA says it “swiftly resolved” the breach and has reviewed security for its core infrastructure and systems.
Mothership reports that SIMBA is emailing affected customers in stages and expected to finish within about a week. Both outlets say the Personal Data Protection Commission (PDPC) is aware of the incident and is investigating. SIMBA says it is working with the relevant authorities.
What was exposed
The exposed fields are names, identity card numbers, dates of birth, mobile numbers and email addresses. SIMBA says no credit card or bank account information was at risk, and it had no information that the data was maliciously misused.
The Star notes that it is unclear whether the customers affected are on mobile plans, broadband or both. SIMBA has about 1.5 million active mobile subscribers, per a Business Times figure it cites, so the exposed group is a small share of the base. Neither report explains how the breach happened.
Why this matters
In Singapore, an NRIC number paired with a name, birth date and working mobile number is the set of details scammers use to sound official. It fits the pattern of calls that claim to come from a telco, a bank or the police and push you to move money. Do not trust a caller just because they know your details.
Our guide to government impersonation scams covers the most common script, and phishing messages explains how to check a link. For the steps after any leak, see what to do after a data breach.
What we do not know
The cause, the data store involved and the PDPC’s findings have not been reported in the sources we read. We will update this page if the PDPC publishes a decision. See our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Calls or SMS posing as SIMBA, a bank or the police that quote your name and ID number to seem credible
- Government or telco impersonation scams that claim your number is linked to a crime
- Phishing emails that copy the breach notice and ask you to confirm your details
What to do if you are affected
- 01Check that any breach email you received came from SIMBA's official channels before acting on it. When in doubt, go to simba.sg yourself.
- 02Do not share OTPs, passwords or banking details with anyone who calls about the breach.
- 03Be cautious of callers who say they are from the authorities and ask you to transfer money. Hang up and call the organization back on a published number.
- 04If you are unsure whether a call or message is a scam, check with the ScamShield helpline on 1799.
- 05Monitor your bank and telco accounts for changes you did not make.
Frequently asked questions
How many SIMBA customers were affected?
SIMBA said 23,549 customers who had registered for its services were affected, according to The Star and Mothership.
What personal data was exposed?
Names, identity card numbers, dates of birth, mobile numbers and email addresses. SIMBA says credit card and bank account information was not at risk.
Has the data been misused?
SIMBA said it had no information that the data had been maliciously misused. That statement reflects the position at the time of its notice.
Is a regulator involved?
Yes. Both outlets report that Singapore's Personal Data Protection Commission is aware of the incident and is investigating, and SIMBA says it is working with the authorities.
How did the breach happen?
The reports we read do not say. It is also unclear whether mobile customers, broadband customers or both were affected.
Sources
- Personal information of over 23,500 Simba telco customers leaked in data breach in Singapore, The Star, 2026-09-28
- Simba data breach, Mothership, 2026-09-28
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.