---
title: "Data breach at National Cancer Centre Singapore"
description: "On 18 September 2026, the National Cancer Centre Singapore (NCCS) sent an invitation to an event for individuals associated with hereditary breast and ovarian cancer syndrome (HBOC), placing the 467 recipients in the visible CC field instead of BCC. This exposed every recipient's email address to th"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-19-national-cancer-centre-singapore
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-19
dateModified: 2026-09-19
---
# National Cancer Centre Singapore

Data breach — Critical

On 18 September 2026, the National Cancer Centre Singapore (NCCS) sent an invitation to an event for individuals associated with hereditary breast and ovarian cancer syndrome (HBOC), placing the 467 recipients in the visible CC field instead of BCC. This exposed every recipient's email address to the others, and in some cases their names and employers could be inferred from workplace email addresses. Being on this list itself reveals an association with a genetic condition. NCCS acknowledged the error, apologised, and reported the incident to the Ministry of Health and to the Personal Data Protection Commission (PDPC), which is investigating.

Exposure of this list allows named individuals to be linked to a sensitive genetic condition, with a risk of stigma or discrimination if the information is cross-referenced with their identity.

| Fact | Value |
| --- | --- |
| Disclosed on | September 19, 2026 |
| Incident dated | September 18, 2026 |
| Accounts affected | 467 |
| Sector | Healthcare |
| Country | Singapore |
| Cause | Direct intrusion |
| Severity | Critical |
| Status | Confirmed |

## Exposed data

- Email address
- Full name
- Employment data
- Health data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- Health data is “special category” data under the GDPR: a leak opens a right to compensation, and the organisation must notify the DPA within 72 hours.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [National Cancer Centre e-mail lapse allegedly exposes patients’ details](https://databreaches.net/2026/09/19/national-cancer-centre-e-mail-lapse-allegedly-exposes-patients-details/) — DataBreaches.net
- [National Cancer Centre e-mail lapse allegedly exposes patients' details including names, workplaces](https://sg.news.yahoo.com/national-cancer-centre-e-mail-091800167.html) — Yahoo News Singapore
- [Names, workplaces of patients with hereditary cancer allegedly exposed in 'administrative error' at National Cancer Centre](https://mothership.sg/2026/09/national-cancer-centre-email-lapse/) — Mothership.SG
- [National Cancer Centre Singapore Apologises After Email Error Exposes Addresses of 467 HBOC Event Invitees; PDPC Investigating](https://goodyfeed.com/national-cancer-centre-singapore-apologises-after-email-error-exposes-addresses-of-467-hboc-event-invitees-pdpc-investigating/) — Goody Feed
- [National Cancer Centre apologises after e-mail lapse exposes patients' details](https://www.pressreader.com/singapore/the-straits-times/20260921/281732686393171) — The Straits Times

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-19-national-cancer-centre-singapore
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees