SINGAPORE – A cybersecurity incident has been reported at the contractor responsible for building three Jurong Region Line (JRL) MRT stations and the new Changi NEWater Factory 3.
Data relating to the two projects was compromised at Shanghai Tunnel Engineering Co (Singapore), a civil engineering and construction company, although it is unclear when this had taken place.
In response to queries on April 27, the Land Transport Authority (LTA) said it is aware of the incident, which has since been reported to the police and the relevant authorities.
The authority added that the incident has not impacted the ongoing construction of the MRT line, and that it has temporarily suspended the construction company’s access to LTA’s digital systems as a precaution.
Meanwhile, national water agency PUB said Shanghai Tunnel Engineering Co (Singapore) has no access to its digital systems.
Its investigation showed that no sensitive data pertaining to the Changi NEWater Factory 3 had been stolen, with the compromised data consisting of project tender documents.
These documents are publicly available on the government procurement portal GeBIZ, said a PUB spokesman, who stressed that the agency takes a “serious view” of cybersecurity and has reminded the contractor to review its measures.
Checks by The Straits Times, including on ransomware portals and hacker forums where stolen data is typically leaked, yielded no results.
Shanghai Tunnel Engineering Co (Singapore) told ST on April 28 that it recently identified a cybersecurity incident and took immediate steps to contain the situation. It did not state when the incident happened.
The company added that it is working with an external cybersecurity specialist to support its investigation.
“We are cooperating fully with the relevant authorities and kindly request that all parties allow the investigation to proceed without interference,” it said.
The company, set up in 1996, has worked on multiple MRT projects, including several stations for the Circle, Downtown and Thomson-East Coast lines.
In 2019, it was awarded a $465.2 million contract to design and build Choa Chu Kang, Choa Chu Kang West and Tengah stations for the JRL, as well as a 4.3km-long viaduct linking them.
The works include integrating the existing Choa Chu Kang station on the North-South Line into Singapore’s seventh MRT line.
Meanwhile, the $205 million contract for Changi NEWater Factory 3 was awarded in November 2025 to Sanli M&E Engineering, which entered a joint venture with Shanghai Tunnel Engineering Co (Singapore) in February 2026 to work on the project.
According to a bourse filing on the Singapore Exchange, Shanghai Tunnel Engineering Co (Singapore) will be responsible for the civil, structural, architectural, structural steelworks and external works.
This includes building services works, but does not include the building management system.
Expected to be ready in 2028, the Changi NEWater Factory 3 replaces the factory in Bedok and will produce up to 50 million gallons of NEWater each day.
