- Joined
- Aug 20, 2022
- Messages
- 30,882
- Points
- 113
PDPC investigating potential data breach involving PCF Sparkletots pupil information
The school’s management notified parents and guardians of the potential breach in a letter dated June 1, seen by The Straits Times.
ST PHOTO: KUA CHEE SIONG
Published Jun 02, 2026, 07:26 PM
Updated Jun 03, 2026, 07:24 PM
SINGAPORE – The Personal Data Protection Commission (PDPC) is investigating a possible data breach involving PAP Community Foundation (PCF) Sparkletots, after a vendor informed the pre-school that information, including details of pupils and parents, was accessed without authorisation.
The school’s management notified parents and guardians of the potential breach in a letter dated June 1, seen by The Straits Times.
PCF Sparkletots said in the letter that the “potential data security incident” involved its vendor LittleLives, adding that “a portion” of the pupil management system used by the school was accessed without authorisation.
A spokesperson for PCF Sparkletots, in a response to ST’s queries, said on June 2 that based on a preliminary report, the unauthorised access has been contained. The school had been informed of the incident by LittleLives, said the spokesperson.
“At this stage, there is no confirmation that any data has been viewed, downloaded or misused,” added the spokesperson.
PCF Sparkletots’ letter to parents did not contain further details on the party behind the breach, when the incident occurred or when LittleLives alerted the school to the matter.
“Investigations are ongoing to determine the full scope and impact of the incident,” said the school in the letter. It added that it has lodged reports with PDPC and the police, and is “in close contact with the Early Childhood Development Agency (ECDA)”.
According to the letter, the information that was involved in the incident included:
- Pupil name and identification details
- Class and centre information
- Parent/guardian contact details
- Invoice-related information
- Payment status or fee descriptions
PDPC told ST on June 2 that it is aware of the incident and that it is investigating.
PCF Sparkletots said: “We understand that investigations are ongoing to determine the full scope and impact of the incident. The matter has been reported to the PDPC, and a police report has been lodged.”
Added the spokesperson: “We take our accountability for data protection seriously. We are working closely with LittleLives and relevant parties as part of a thorough investigation, and will strengthen security measures and assess any potential impact.”
In response to ST queries, ECDA noted that PDPC and police investigations are ongoing and that PCF is working with LittleLives to assess the full scope of the incident.
ECDA added that it is working closely with PCF and LittleLives to ensure that a thorough investigation is conducted and that measures are put in place to prevent a recurrence.
The Cyber Security Agency of Singapore, meanwhile, said it has reached out to LittleLives to advise them on recovery measures.
