MoneySmart breach: personal data of some Singapore and Hong Kong customers copied, identification numbers and financial profiles included

What happened

MoneySmart, the personal finance comparison platform, said it discovered on October 29, 2026 that an unauthorised third party had gained access to some of its internal IT systems. Its investigation confirmed that personal data belonging to some customers in Singapore and Hong Kong was copied. The company said it stopped the unauthorised access as soon as it discovered the incident, took steps to secure its systems, and engaged independent cybersecurity and digital forensics experts to investigate. It notified regulators in both markets — Singapore’s Personal Data Protection Commission and Monetary Authority of Singapore, and Hong Kong’s Office of the Privacy Commissioner for Personal Data and Insurance Authority. Affected customers were emailed on November 2 and 3, and the company confirmed the breach in response to press queries on November 3. Chief executive Vinod Nair apologised to affected customers and said services continue to operate as normal. MoneySmart has not said how the attacker got in, and it has not given a count of affected customers.

Who is affected

Some MoneySmart customers in Singapore and Hong Kong — people who used the platform to compare or apply for financial products such as credit cards, loans and insurance. In its response to The Straits Times on November 3, the company said the data that may have been accessed includes personal particulars (names, dates of birth, nationality and personal identification numbers), contact information (email addresses, mobile numbers and shipping addresses), financial profiles (income ranges, life stages and financial products currently owned), and vehicle information and car insurance inquiries or policies. In the customer emails seen by CNA, the company said the affected systems held information users provided when comparing or applying for financial products, including names and email addresses, and that customers who submitted reward claims may also have had shipping addresses and application or policy reference numbers copied. MoneySmart is contacting affected customers directly to explain which of their information was involved.

How serious

The concrete risk is targeted phishing and impersonation fraud. Identification numbers and dates of birth are hard to change, and a financial profile — income range, products owned, insurance details — lets a scammer pose as a bank, an insurer or MoneySmart itself with details a genuine institution would know. MoneySmart’s own warning points the same way: the company says it will never ask for passwords, one-time passwords or banking details over the phone or by email, which is the follow-on approach customers should expect. There is no report so far of the copied data being misused, and no payment card or bank account data has been named among the data involved.

What to do now

Treat any message that references your real financial products, income band or insurance details with suspicion even when it looks informed — that is exactly what the copied data enables. Contact your bank or insurer only through its official app or the number on its own website, never through a link or number in a message. Never share a password, one-time password or banking detail by phone or email, whoever claims to ask. Check your bank, card and insurance accounts for unfamiliar activity, and follow the steps in MoneySmart’s own email if you received one — it sets out which of your data was involved. If you did not receive an email, MoneySmart says it is contacting affected customers directly; you can also check the address the company published for questions.

Sources: The Straits Times reporting (via Tabla), November 3, 2026 · Tech in Asia, November 3, 2026 · Marketing-Interactive, November 3, 2026