Cybersecurity incident at MRT contractor prompts probe, systems access suspended

SINGAPORE: Authorities are investigating a cybersecurity incident involving Shanghai Tunnel Engineering Co (Singapore) Pte Ltd (STECS), a contractor engaged in major infrastructure projects including the Jurong Region Line and Changi NEWater Factory 3.

The Land Transport Authority (LTA) revealed on 27 April 2026 that it had temporarily suspended the company’s access to its digital systems as a precautionary measure.

“There is no impact to the ongoing construction of the MRT line,” LTA said, without elaborating on the nature or scope of the compromised data.

The authority added that it had reported the incident “to the police and relevant regulatory authorities”, indicating that investigations are underway.

PUB confirms no sensitive water data affected

National water agency PUB said separately that no sensitive data related to Changi NEWater Factory 3 had been affected by the incident.

“The data that was compromised consisted of project tender documents, which are publicly available on the government procurement portal GeBIZ,” PUB stated.

It further clarified that STECS does not have access to its digital systems.

The agency’s statement sought to reassure the public regarding the integrity of Singapore’s water infrastructure and associated data security.

LTA and PUB confirmed the incident after media outlet CNA received a tip-off alleging exposure of internal company data.

Screenshots provided to CNA reportedly showed computer folders containing files related to financial matters, including cashflow and payments.

In response to media queries, STECS confirmed it had identified a cybersecurity incident within its systems.

“We have taken immediate steps to contain the situation and are engaging an external cybersecurity specialist to support our investigation,” the company said.

It added that law enforcement authorities are involved and investigations are ongoing.

“While their investigation is ongoing, we will not be taking a formal position or providing any further comments at this time,” it stated.

Projects and contracts involved

The Jurong Region Line project forms part of Singapore’s seventh MRT line and includes the design and construction of Choa Chu Kang, Choa Chu Kang West and Tengah stations.

The contract for this segment was awarded in 2019 and is valued at S$465.1 million.

Separately, Changi NEWater Factory 3 will process treated water from the Changi Water Reclamation Plant to produce NEWater.

The S$205 million contract for this project was awarded in November 2025 to Sanli M&E Engineering, which formed a joint venture with Shanghai Tunnel Engineering Co (Singapore).

Company background and track record

STECS specialises in rail transit and underground space construction.

According to its official website, the company has completed major civil engineering contracts for LTA, PUB and Marina Bay Sands.

Established in 1996, STECS is a subsidiary of Shanghai Tunnel Engineering Co., Ltd (STEC), a Chinese state-owned enterprise founded in 1965.

STEC gained prominence as the contractor for China’s first river crossing tunnel, the Shanghai Dapu Road Tunnel.

Since entering Singapore, STECS has expanded from a tunnel subcontractor into a leading main contractor within the civil engineering sector.

The company has contributed to several major MRT lines, including the North East Line, Downtown Line, Thomson-East Coast Line and Cross Island Line.

It has also undertaken large-scale projects for clients such as the Land Transport Authority, Public Utilities Board, Marina Bay Sands and Changi Airport Group.