National Cancer Centre Singapore
CriticalConfirmedHealthcare
On 18 September 2026, the National Cancer Centre Singapore (NCCS) sent an invitation to an event for individuals associated with hereditary breast and ovarian cancer syndrome (HBOC), placing the 467 recipients in the visible CC field instead of BCC. This exposed every recipient's email address to the others, and in some cases their names and employers could be inferred from workplace email addresses. Being on this list itself reveals an association with a genetic condition. NCCS acknowledged the error, apologised, and reported the incident to the Ministry of Health and to the Personal Data Protection Commission (PDPC), which is investigating.
Exposure of this list allows named individuals to be linked to a sensitive genetic condition, with a risk of stigma or discrimination if the information is cross-referenced with their identity.
- Disclosed on
- September 19, 2026
- Incident dated
- September 18, 2026
- Accounts affected
- 467
- Sector
- Healthcare
- Country
- Singapore
- Cause
- Direct intrusion
Exposed data
- Email address
- Full name
- Employment data
- Health data
You are only affected if you had an account or an order with this organisation.
What you can do
- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.
Sources
- National Cancer Centre e-mail lapse allegedly exposes patients’ detailsDataBreaches.net
- National Cancer Centre e-mail lapse allegedly exposes patients' details including names, workplacesYahoo News Singapore
- Names, workplaces of patients with hereditary cancer allegedly exposed in 'administrative error' at National Cancer CentreMothership.SG
- National Cancer Centre Singapore Apologises After Email Error Exposes Addresses of 467 HBOC Event Invitees; PDPC InvestigatingGoody Feed
- National Cancer Centre apologises after e-mail lapse exposes patients' detailsThe Straits Times
Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact