What it can look likeFriendly contactA flattering message about your work
What to doCheck who they areFind the firm yourself
What it can look likeSmall paid favourA short report or talk, good fee
What to doTell your named personBefore saying yes
What it can look likeMore specific askPublic facts turn into client detail
What to doStopClient information stays inside
What it can look likeMoves to a private app“Easier on chat”
What to doKeep every messageScreenshots, dates, profile links
What it can look like“Keep this between us”Asks you not to tell your boss
What to doReport it that dayTo your named person
What it can look likeClient informationFiles, drawings, names, schedules
What to doDon’t sendTell the client’s security contact
the short answer
How do I know my clients are being targeted? Usually you can’t. Your client and the security agencies see that, and you don’t. What you can see is an approach reaching your own people or systems. One odd message means little. A pattern means more. I found no public Singapore figure on how often SMEs are approached.
How do I keep myself and my staff clear of it? Know what you hold, limit who holds it, make it easy and safe to speak up, and know who to call. Owners get approached too.
Recent overseas reports about alleged spying around a large technology company prompted this page. The claims are unproven and I make no claim about any person or company.
why suppliers
- MHA said in December 2021 that social media has made it easier for foreign intelligence services to talent-spot and groom people, and that individuals in the private sector with access to sensitive information have been approached. MHA
- In a written reply on 8 September 2026 the Minister said there was no rise in Singapore-registered firms offering jobs as cover, but an uptick in websites posing as Singapore-based entities to recruit people for sensitive information, mostly set up overseas. People with sensitive access should “report suspicious approaches to the relevant authorities” and verify an entity before giving more. Hansard (Vol 96, Sitting 35, 8 Sep 2026)
- On 6 July 2021 the Minister said organisations more exposed by their work need to be even more aware. Hansard (Vol 95, Sitting 32, 6 Jul 2021)
- My count from the open GeBIZ dataset, April 2021 to March 2026: 957 named suppliers appear in 1,467 published award records from defence (MINDEF, DSTA), home affairs (MHA, HTX), the National Security Co-ordination Secretariat, MFA, CPIB and the Istana. The work included IT, building works, security, training and transport, so a caterer or bus firm may be in scope. data.gov.sg
Limits of that count. Company size is not in the data. An award does not mean access to sensitive information. Which agencies count is my own choice. Job types are keyword matches. Defence has only 178 of those records, so much of its buying may sit outside this dataset.
A list the government publishes. Under the Significant Investments Review Act 2024, the Minister can designate companies in the interest of national security, and the names are published in the Gazette. The official list (updated 30 September 2026) has 11 companies:
- Defence, under the Minister for Defence: ST Engineering Defence Aviation Services, ST Engineering Digital Systems, ST Engineering Land Systems, ST Engineering Marine and Sembcorp Specialised Construction.
- Home affairs, under the Minister for Home Affairs: ST Logistics.
- Energy and chemicals: ExxonMobil Asia Pacific, Singapore Refining Company, Aster Chemicals and Energy, Aster Port & Terminals and Aster Power.
Shell Singapore’s designation was cancelled on 19 November 2025. Being on this list says nothing about spying or any threat to these companies. If you supply one of them, treat that work as sensitive and ask who to tell if something looks wrong.
warning signs
-
Sign 1
An approach out of the blue on LinkedIn or by email
- you may see
- A role that looks too good, from someone you don’t know. In 2020 the FBI urged caution about “implausible career opportunities”. In 2022 the UK government said MI5 had seen over 10,000 disguised approaches on professional networking sites.
- could also be
- A real recruiter.
- do this
- Find the firm yourself and call its listed number. Don’t accept an unknown contact because they know people you know. The UK’s Think Before You Link app helps check a profile.
-
Sign 2
Paid reports or consulting for your staff
- you may see
- In the Yeo case below, people were paid to write reports said to be for clients in Asia.
- could also be
- A genuine expert network.
- do this
- Staff declare paid outside work to the named person. No client facts go into any paid work.
-
Sign 3
Questions about your client or its end users
- you may see
- A new contact asks who you work for, what you build for them, or who uses it.
- could also be
- A sales rep being nosy.
- do this
- Say “I can’t discuss clients.” Write down who asked and when.
-
Sign 4
A customer who is odd about end use
- you may see
- Singapore Customs lists these red flags: unclear identity, reluctance to declare end use, unfamiliarity with product specifications but insisting on buying, declining installation or training, a vague delivery location, and a freight forwarder listed as final user.
- could also be
- A new buyer who is in a hurry.
- do this
- Know what it is for, where it goes and why it is needed. Check the Customs red-flag list.
-
Sign 5
Requests beyond the contract
- you may see
- A client contact, or someone who says they speak for the client, asks for more than the contract covers.
- could also be
- Scope creep.
- do this
- Anything outside the contract goes through the named person.
-
Sign 6
Gifts, trips and invitations to speak
- you may see
- CPIB says gifts and entertainment that are too frequent or lavish, or meant to win an unfair advantage, can amount to corruption. In the Xu case below, an invitation to give a talk abroad, with travel and a stipend paid, was the start. Source: CPIB.
- could also be
- A normal client courtesy.
- do this
- Write a rule, keep a register, and have the owner sign off paid trips.
-
Sign 7
An investor or buyer who wants detail early
- you may see
- Someone who is keen to see your client list, designs or schedules before any deal is signed.
- could also be
- A careful buyer doing due diligence.
- do this
- Share the minimum until a deal closes. Check where the money comes from. The US-led Secure Innovation guidance says to think about who you are working with, what you are sharing, and how you protect it. The page is now archived but still readable.
-
Sign 8
A website or firm that doesn’t add up
- you may see
- MHA’s reply of 8 September 2026 reported an uptick in websites posing as Singapore-based entities to recruit people for sensitive information, mostly set up overseas.
- could also be
- A young firm with a thin website.
- do this
- Check ACRA BizFile registration, ask for a landline, and ask who the client is.
-
Sign 9
Old routers and open remote access
- you may see
- A joint advisory from CISA and international partners (April 2026) says covert networks of compromised devices are made mostly of small office and home routers. A 2024 US court-authorised operation cleared malware from hundreds of such routers; most were end-of-life, and the FBI urged owners to replace them. Sources: CISA advisory, US Department of Justice.
- could also be
- Kit that works fine and nobody has touched.
- do this
- Retire routers the maker no longer supports. Use multi-factor sign-in on remote access.
-
Sign 10
The same question reaching several staff
- you may see
- Two or three people get near-identical questions in the same week.
- could also be
- A survey.
- do this
- Compare notes through the named person.
a 30-day plan for a firm with no security team
-
1. One named person
- Do this
- A director or trusted manager, plus a backup.
- Who
- Owner
- Done when
- Both are named and staff know who they are.
-
2. List what you hold
- Do this
- Drawings, schedules, site access, staff names and passwords for each sensitive client.
- Who
- Named person
- Done when
- One page lists it, with who can see each item.
-
3. Need to know
- Do this
- Cut access to those who need it. No client names on your website or LinkedIn unless the client agrees. Staff CVs shouldn’t list project detail.
- Who
- Named person, HR
- Done when
- Access list trimmed. Website and CVs checked.
-
4. A 20-minute briefing
- Do this
- What an approach looks like. The line to use: “Thanks, I’ll need to check with my company.” Owners attend too.
- Who
- Owner, named person
- Done when
- Everyone has heard it once.
-
5. A no-blame reporting line
- Do this
- Anyone who reports early is thanked, even if they already replied. CPIB advises a reporting channel where staff can raise concerns and be protected from being identified or retaliated against.
- Who
- Owner
- Done when
- Staff know how to report and that nobody is punished for it.
-
6. Gifts and travel rule
- Do this
- When gifts may be accepted and what records are kept (the CPIB advice). A clean laptop and phone for sensitive trips. Know the export rules before carrying technical data.
- Who
- Owner, named person
- Done when
- Rule written, register started.
-
7. Contracts and vendors
- Do this
- Ask each sensitive client who to tell and how fast. Check what your own suppliers can see. Add a security clause to contracts. Work out what happens if a supplier is compromised. The UK NCSC publishes 12 supply chain security principles.
- Who
- Owner, named person
- Done when
- Each client has a named contact. Each supplier’s access is listed.
-
8. Accounts and equipment
- Do this
- Multi-factor sign-in on email and remote access. Retire unsupported routers. Work towards CSA Cyber Essentials.
- Who
- Whoever looks after IT
- Done when
- Checklist signed off by the named person.
In the Yeo case, the US Department of Justice says handlers looked for people with weak points: dissatisfaction with work or financial difficulties. So money trouble or unhappiness is a reason to help someone. It is not grounds for suspicion.
judge the behaviour, not the background
Nationality, race, religion, accent or where someone studied are not warning signs. Never treat staff or customers as suspects because of them. The best-documented case tied to Singapore involved a Singaporean, and several accused people below were later cleared.
The Tripartite Guidelines tell employers to avoid using nationality or race as a selection criterion: TAFEP. On the Workplace Fairness Act, check MOM or Singapore Statutes Online for the current status. A law firm reported in December 2025 that it is expected to come into force at the end of 2027: HSF Kramer.
Get legal advice before you monitor staff devices or messages. The PDPA applies.
if someone has been approached
- do
- Stop replying, without warning them. Keep messages, screenshots, dates and profile links. Tell the named person the same day.
- don’t
- Confront anyone, run your own investigation, delete anything, send anything else, or punish the person who told you.
- if something was handed over
- Get a lawyer early, and report. I found no published promise of confidentiality or immunity.
the law, briefly
- Official Secrets Act 1935. Section 5(1)(e) reaches information obtained by someone who holds a contract made on behalf of the Government or a specified organisation, and by people employed under them. Section 10 makes it a duty to give information on demand to a police officer about an offence or suspected offence under the Act. Section 16(3) can make directors and officers liable for a company’s offence unless they prove it happened without their knowledge or consent. Under section 17(2), section 5 offences carry up to $2,000 and 2 years in a District Court. SSO
- Foreign Interference (Countermeasures) Act 2021. Aimed at interference in domestic politics and society, not trade secrets. MHA
- Prevention of Corruption Act. Up to $100,000, 5 years, or both for each count, and up to 7 years where the matter concerns a contract with the Government. CPIB
- Strategic goods. Singapore Customs
- When to get a lawyer. You have already shared something, a contract says how to report, you are monitoring staff, you are dismissing someone, or you have export licence questions.
real cases
These are the cases I found most useful for suppliers, from court records, government statements and news reports. It is not a full list. Status is as far as I could find on 9 Nov 2026. Allegations are marked. People are named only where they were convicted or pleaded guilty.
Singapore
-
Dickson Yeo: paid reports for a foreign state
- Linked to
- China, as named in the US court record. MHA did not name a state.
- What happened
- MHA says his handlers first contacted him in 2015 through an online professional networking site, then asked him to write reports, and he set up a front company and posted job ads to spot people with sensitive access. He pleaded guilty in a US court on 24 July 2020, and ISD released him on 14 December 2021 under a Suspension Direction, saying he did not pose a security threat that warranted continued detention.
- For your firm
- Treat a well-paid report on your client’s work as a warning sign.
- Source
- US Department of Justice · MHA, 14 Dec 2021
-
An academic and spouse lose Singapore residency
- Linked to
- No state named.
- What happened
- MHA cancelled their permanent residence, saying he had been identified as an agent of influence of a foreign country. He denied it. Reuters reported that he then resigned as an independent director of a listed company’s property arm.
- For your firm
- Look at board and adviser roles as well as staff.
- Source
- MHA statement · His denial · Reuters
-
A person designated under the foreign interference law
- Linked to
- No state named.
- What happened
- MHA designated a person as a Politically Significant Person under FICA, citing activities directed towards a political end in Singapore. The release does not allege spying.
- For your firm
- That law is about influence in politics and society, not trade secrets.
- Source
- MHA release · MHA on FICA
-
Three men charged over servers
- Linked to
- No state named.
- What happened
- Three men were charged over alleged false statements to server makers about where the servers would end up. It is part of a police investigation into 22 people and companies, and I could not find an outcome.
- For your firm
- Ask for the end user in writing and check it.
- Source
- techpartner.news
-
Leonard Glenn Francis: a ship supplier who bribed Navy officers
- Linked to
- None. This was corruption, not foreign spying.
- What happened
- The owner of a Singapore-based ship-servicing firm pleaded guilty in 2015 to bribing US Navy officers, who passed him classified information. He was sentenced to 15 years in November 2024.
- For your firm
- A supplier can be the one offering the gifts, so a gifts rule works both ways.
- Source
- Defense News (AP)
-
UNC3886 and the telcos
- Linked to
- No state named.
- What happened
- The Minister said in July 2025 that an advanced threat actor, UNC3886, had attacked critical infrastructure. CSA and IMDA said in February 2026 that all four major telcos were targets and that the actor got into some parts of telco networks.
- For your firm
- If you supply a telco or critical operator, tell them fast if your own systems are hit.
- Source
- CSA, 9 Feb 2026
-
A think-tank website blocked
- Linked to
- No state named.
- What happened
- MHA said it issued an Access Blocking Direction under the Online Criminal Harms Act against a think-tank website, after a police report by MFA. In the same reply it reported an uptick in websites posing as Singapore-based entities to recruit people for sensitive information.
- For your firm
- Check a firm’s registration before you share anything.
- Source
- MHA reply, 8 Sep 2026 · Hansard
Staff approached and insiders
-
Yanjun Xu: an invitation to speak in China
- Linked to
- China, as the court record said: an officer of its Ministry of State Security.
- What happened
- In March 2017 a GE Aviation employee was asked to give a report at a university in China, with travel and a stipend paid. In 2018 the officer asked for system specification and design process material. He was convicted in November 2021 and sentenced to 20 years in November 2022.
- For your firm
- A paid talk abroad can be the start. Staff declare paid outside work.
- Source
- US Department of Justice
-
Linwei Ding: files copied from Google
- Linked to
- China, as the US Department of Justice said.
- What happened
- A jury convicted a former Google software engineer on seven counts of economic espionage and seven of theft of trade secrets. The Department says he uploaded more than two thousand pages of confidential AI information to a personal cloud account.
- For your firm
- Watch for bulk copying to personal accounts.
- Source
- US Department of Justice
-
A chip engineer who moved to a supplier
- Linked to
- No state reported.
- What happened
- A former TSMC engineer who joined the equipment supplier Tokyo Electron’s Taiwan unit asked former colleagues for confidential 2-nanometre etching information, to help win supply positions. In April 2026 a Taiwan court gave him 10 years and three TSMC staff 2 to 6 years. The supplier was fined NT$150 million, reported as the first company penalised under the National Security Act. The ruling was open to appeal when reported.
- For your firm
- A supplier can answer in court for what a new hire brings in. Ask what they may not share.
- Source
- Taipei Times
-
Six people jailed in the UK for spying
- Linked to
- Russia, as prosecutors said.
- What happened
- Six people were convicted or pleaded guilty in the UK of spying, and the ringleader got over 10 years. In one operation a member tried to lure a journalist into a romance honeytrap.
- For your firm
- A friendly personal approach can be the lure, not only a job offer.
- Source
- Euronews (AP)
-
A fake photographer on LinkedIn
- Linked to
- Iran, as SecureWorks researchers said. No court case.
- What happened
- In January 2017 an employee at a targeted organisation was contacted on LinkedIn by a fake London photographer, who moved the chat to Facebook, email and WhatsApp and then sent a spreadsheet that installed malware. The targets were in telecoms, government, defence, oil and finance in the Middle East and North Africa.
- For your firm
- Moving to private apps, then “open this at work”, is the pattern to stop.
- Source
- SecurityWeek
Hiring and end users
-
Christina Chapman: remote IT staff who were not who they said
- Linked to
- North Korea, as the US Department of Justice said.
- What happened
- She helped North Korean IT workers pose as US residents to get remote jobs at more than 300 US companies. She pleaded guilty on 11 February 2025 and was sentenced to 102 months on 24 July 2025.
- For your firm
- Verify remote hires and contractors.
- Source
- US Department of Justice
-
Nikolay Goltsev and Kristina Puzyreva: an export network
- Linked to
- Russia, as the US Department of Justice said.
- What happened
- They used two Brooklyn companies to buy US electronics and ship them through front companies in other countries to Russia. Goltsev was sentenced to 40 months in January 2025 and Puzyreva to 24 months in July 2024.
- For your firm
- End-user paperwork can be false. Know where the goods go.
- Source
- US Attorney’s Office, EDNY
Supply chains and investors
-
SolarWinds
- Linked to
- Russia, as the US and UK governments said.
- What happened
- Hackers used software from a contractor to get into nine US agencies and 100 private firms. The White House said it had high confidence that Russia’s SVR was responsible, and the UK NCSC said it was highly likely.
- For your firm
- The software and updates you install are someone else’s way in.
- Source
- CyberScoop
-
Crypto AG: an encryption supplier owned by spy agencies
- Linked to
- The United States and Germany, as a Swiss parliamentary report said.
- What happened
- The Swiss encryption firm was owned by the CIA and Germany’s BND, and its products were deliberately weakened so the West could read messages passing over them. The Swiss parliamentary oversight body reported on it in November 2020.
- For your firm
- Check who owns your suppliers. Spying is not only done by rivals.
- Source
- The Register
-
A UK order on a chip plant purchase
- Linked to
- No state named.
- What happened
- The UK ordered Nexperia BV to sell at least 86% of the former Newport Wafer Fab. The notice cites risks around technology and know-how, and the site’s links to a local technology cluster. It does not allege spying.
- For your firm
- Ownership changes can draw a government review.
- Source
- UK government notice
Accused, then cleared or collapsed
-
A Japanese machinery maker
- Linked to
- No state named.
- What happened
- Three executives were detained and indicted in March 2020 over exports of spray dryers, which they said were legal. The charges were later dropped, and in August 2025 police and prosecutors apologised for an illegal investigation.
- For your firm
- Keep export paperwork and get a lawyer early.
- Source
- CBS News (AFP)
-
An MIT professor
- Linked to
- None alleged. The charges were about funding disclosure on grant forms.
- What happened
- Prosecutors recommended dismissing all three charges against the professor, who had pleaded not guilty.
- For your firm
- A charge is not a finding.
- Source
- MIT Technology Review
-
A BrahMos engineer in India
- Linked to
- Pakistan, as prosecutors alleged. Not proven.
- What happened
- The Bombay High Court acquitted a former engineer at the missile maker of charges including espionage. The Uttar Pradesh government appealed, and the Supreme Court issued notice on 13 July 2026.
- For your firm
- A first verdict can change on appeal.
- Source
- LiveLaw
-
A UK parliamentary researcher and a teacher
- Linked to
- China, as the alleged recipient.
- What happened
- Two men were charged with passing information to China. Both denied wrongdoing, and the prosecution offered no evidence in September 2025.
- For your firm
- Judge the behaviour you can see, not the background.
- Source
- ITV News
Sources, checked 9 Nov 2026 (cases carry their own links)
- MHA, 14 Dec 2021
- Hansard, written reply, 8 Sep 2026
- Hansard, written reply, 6 Jul 2021
- data.gov.sg, Government Procurement via GeBIZ
- GOV.UK, Think Before You Link
- Singapore Customs, red flags
- CPIB, prevention of corruption
- US ODNI, Secure Innovation (archived)
- CISA advisory AA26-113A
- UK NCSC, supply chain security
- CSA Cyber Essentials
- Office of Significant Investments Review, designated entities
- Official Secrets Act 1935
- MHA, FICA
- TAFEP, Tripartite Guidelines
Written 9 Nov 2026. Prompted by recent news reports, whose claims are unproven. I make no claim about any person or company in those reports. Case summaries are from the linked sources and status may have changed. The lessons are my own view. I’m not a lawyer and this isn’t legal advice. Not affiliated with any agency or organisation mentioned.