The ShinyHunters extortion gang has claimed responsibility for a recently disclosed Ernst & Young data breach, saying it obtained credentials for some of the company’s systems via a supply-chain attack.

Ernst & Young disclosed the breach earlier this month, saying a third-party support ticket system used by its IT personnel was compromised and support tickets that may contain client tax information were stolen.

EY says it detected unusual activity on April 23 and determined that the attacker accessed the platform between March 28 and April 12, downloading multiple documents.

“EY uses a third-party information technology service management platform to help EY information technology personnel provide support to EY teams performing tax-related work for clients,” reads the EY data breach notification.

“Support tickets submitted through the platform may include documents containing client tax information”

Th notification goes on to say that the stolen documents contained personal and financial information included in or used to prepare tax filings.

However, the company has not disclosed the name of the compromised support system, the specific types of information exposed, or how many people were affected.

At the time the breach was disclosed, no ransomware or data extortion group had claimed responsibility for the attack.

Today, the ShinyHunters extortion gang added Ernst & Young to its data leak site, claiming it conducted the attack and threatened to release the allegedly stolen data if the company does not contact the group by July 31, 2026.

The threat actors claimed to BleepingComputer that EY credentials were obtained through a supply-chain attack and used to breach the company. These stolen credentials allegedly allowed them to breach Ernst & Young’s Jira, GitHub, and Azure environments.

The threat actor would not identify the allegedly compromised third party or disclose what data was stolen. However, it claimed that the information EY acknowledged as compromised was exposed, along with more data.

BleepingComputer has no way to verify the threat actor’s claims independently, and Ernst & Young has not confirmed that ShinyHunters was behind the attack.

BleepingComputer contacted Ernst & Young again Monday morning to ask whether ShinyHunters was behind the attack and whether the company had received an extortion demand from the group.

We also asked EY to identify the compromised support system and disclose how many people were affected by the breach.

Ernst & Young previously said it secured its systems, removed the unauthorized access, and notified federal law enforcement.

Affected clients are being offered 24 months of identity monitoring and restoration services through Experian.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Get the whitepaper

Your workforce is building agents in Salesforce Agentforce, Microsoft Copilot Studio, Cursor, Zapier, Retool, and a dozen other tools, often without visibility or approval from IT or security.

For IT and security teams, the decision of whether or not agents should be used has already been made by the business, one shadow agent at a time. The challenge now is keeping up. New agents can be created in minutes, connected to sensitive systems in a click, and changed daily.

The job is to maintain visibility and control (who built it, what it can access, what it can do) while enabling the workforce to keep experimenting, automating, and moving fast.

That’s exactly what Nudge Security does.

Why shadow AI agents are riskier than shadow AI apps

AI chatbots are a known problem by now. Shadow AI agents are a different, and arguably bigger, one. An agent holds persistent permissions. It connects to your corporate apps and data. It takes action on its own, without waiting for someone to hit send.

When an unmanaged agent goes wrong, the result isn’t a bad response in a chat window. It’s a system that got touched.

The numbers back this up:

• 48% of cybersecurity professionals rank agentic AI as the most dangerous attack vector of 2026 (Dark Reading).
• 80% of organizations say they’ve already encountered agentic AI risks (SailPoint).
• Only 21% of IT leaders say they have a mature agentic AI governance program in place (Deloitte).

That gap between exposure and readiness is exactly where shadow AI agents live.

Day One: Find shadow AI agents

You can’t govern an agent you don’t know exists. Nudge Security gives you an immediate inventory of AI agents, across the most popular agentic platforms including Microsoft Copilot, Google Gemini, ChatGPT, Claude Managed Agents, Tines, ServiceNow, Salesforce Agentforce, Cursor Automations, and many more.

No spreadsheets. No self-reporting. No waiting for an incident to find out what’s already running in your environment.

Shadow AI agent discovery: How it works

Most AI agent discovery methods have the same blind spot: they only see what agentic platform vendors choose to expose through a public API. That leaves out an enormous amount of shadow AI activity, because a lot of the platforms where employees build agents don’t offer an API, or don’t expose agent details through it.

Nudge Security closes that gap with two complementary discovery methods:

API-based discovery connects to the platforms that do expose agent data: Salesforce Agentforce, Microsoft Copilot Studio, Google Gemini, ServiceNow, n8n, Tines, ChatGPT, Abacus.AI, and Workato. It continuously pulls agent name, creator, creation date, status, configuration, and risk insights.

Browser-based discovery, through the Nudge Security browser extension, covers the platforms that don’t expose an API at all: Cursor automations, OpenAI Agent Workflows, ChatGPT workspace agents, Zoom AI Workflows, Atlassian Rovo, Retool, Zapier Agents, and HyperAgent. The extension passively observes the moment an employee views, lists, or creates an agent, then adds it to your inventory automatically, with the creator, connected apps, permissions, and risk signals already attached.

Between the two channels, Nudge Security covers 17+ agentic platforms today, and the list keeps growing based on where customers are actually seeing agent activity.

Why browser-based shadow AI agent discovery matters

The agents built on platforms without APIs aren’t a minor edge case. They’re often where the real shadow AI lives. These are the fast, low-friction tools your engineers, ops teams, and product managers already love, precisely because nobody has to ask IT for permission to use them.

That’s also why they tend to carry the broadest access and the least oversight. An agent built in an afternoon to save someone twenty minutes can end up with standing access to a CRM, a code repository, or a shared drive, and no one outside the person who built it knows it’s there.

Assess: know what each agent can actually do

Finding an agent is only useful if you know what it’s capable of. For every agent it discovers, Nudge Security automatically surfaces these agentic AI risks:

• Publicly accessible agents that anyone in the org can use
• Agents with excessive, write, or destructive permissions
• Hardcoded credentials or PII sitting in agent instructions
• Unauthenticated MCP connections
• Dormant agents that still retain active access
• Agents whose creators have already left the organization

Govern: close the loop without becoming the bottleneck

Discovery tells you what’s out there. Governance is what you do about it, and Nudge Security is built so that step doesn’t require your team to chase down every agent creator one by one.

Once an agent is in your inventory, you can:

• Set an approval status: Approved, Allowed, In Review, or Not Permitted, for every agent in your environment.
• Assign an owner. A technical contact who’s accountable going forward, which may or may not be the same person who originally built the agent.
• Nudge the owner directly, through the browser extension, Slack, Teams, or email, to confirm intent, justify access, or fix a risky configuration. Their response is captured automatically in the agent record.

It’s proactive AI governance that doesn’t ask you to play whack-a-mole with every new agent that pops up, and it doesn’t ask your workforce to slow down to get security’s blessing before they build something useful.

The bottom line

Your job isn’t to stop people from building agents. It’s to make sure that when they do, someone knows it happened, knows what the agent can touch, and can act fast if something looks wrong.

Nudge Security gives you Day One AI agent discovery with risk context and governance workflows across the agentic platforms your employees are actually using.

Ready to see the agents that are already running in your environment? Start a free 14-day trial.

Sponsored and written by Nudge Security.

from the affordable-fiber-optics-is-woke dept

Earlier this year the Trump administration decided to illegally dismantle the 2021 Digital Equity Act, which was intended to help push internet access into long-neglected parts of the U.S. The Act took very vague aim at digital redlining, or the longstanding practice by telecom giants of refusing to upgrade (or at times even timely repair) broadband service in minority and low-income neighborhoods.

Big ISPs like AT&T have long been caught not only refusing to upgrade or repair broadband access in minority areas of cities like Detroit and Cleveland, but charging minority neighborhoods more money for slower service than their less diverse, more affluent counterparts.

Here’s the thing: the Digital Equity Act barely mentions race; it simply included some vague language stating that deployments and broadband grants must be even and non-discriminatory. The law identified minority status as one of eight nonexclusive indicators of barriers to digital access, while separately prohibiting discrimination in programs receiving funds.

As it has done with numerous other programs of this kind aimed at lowering broadband bills, the Trump administration clumsily — and quite illegally — tried to dismantle the whole law last year, insisting it was somehow racist against white people.

Last week, the DC District Court issued a ruling that allowed the Act to survive, but stripped out the already modest race-based components of the law, declaring them unconstitutional.

Groups like the National Digital Inclusion Alliance, which had done a lot of good studies on broadband redlining, celebrated the decidedly mixed bag:

“We are proud to have pushed to keep the Digital Equity Competitive Grant Program alive. This crucial program provides communities across the country not just with access or technology, but the skills, confidence, and pathways necessary to fully participate and thrive in our digital age. We fundamentally object to the government’s position that empowering Black and Brown communities is unconstitutional.“

So the competitive grant program at the heart of the law will continue, but there’s no real consensus on what that will look like or how helpful it will be under a federal government too racist and corrupt to function in the public interest. And there’s not much left to address the very real issue of broadband digital discrimination, which runs parallel with racial discrimination in other U.S. infrastructure sectors like energy.

The Infrastructure Act not only featured $42.5 billion to expand broadband access, it featured a lot of included (and adjacent) legislation intending to address racism in broadband and broadband affordability more generally. Most of that’s been brutally stripped away by the Trump administration, which is instead funneling billions of dollars to Elon Musk for costly Starlink service, then declaring the problem solved.

It’s a lovely bundle of corruption, racism, and regulatory/court capture all thrown into a stew by a bunch of zealots keen to pretend they’re engaging in policy reform and serious legal analysis.

Filed Under: broadband, digital discrimination, digital equite act, fiber, illegal, racism, redlining, ruling, telecom

PATCHES

One bug disabled the security service on restart, another blocked installation on hardened RHEL systems

Not content with broken Windows updates, Microsoft has disclosed two problems with Defender for Endpoint on Linux – one that could disable the security service after a reboot, and another that prevents updates on FIPS-enabled Red Hat Enterprise Linux 8 and 9.

The more serious problem affected versions 101.26042.0000 through 101.26042.0009 across all supported Linux operating systems. After an upgrade or reinstall followed by a reboot, “the Defender service might be disabled on some devices,” according to Microsoft.

“If you use Defender for Servers (Plan 1 or 2) with Defender for Cloud and have the MDE [Microsoft Defender Endpoint] integration enabled, automatic updates for the MDE.Linux extension are enabled by default, which means your machines could have received an affected version automatically,” it explained.

“If an affected version was installed, the issue might impact active protection on rebooted devices until remediation steps are taken.”

Microsoft did not specify what caused Defender to become disabled, but anything that could knock out endpoint protection will give administrators sweaty palms.

A separate problem affected RHEL 8 and 9 systems running in FIPS mode: the 101.26042.x update could fail to install, leaving devices on their previous version. FIPS refers to US Federal Information Processing Standards, which in this context impose requirements on the cryptography used by government and other regulated systems.

Although Microsoft’s alert did not mention an available update, its release notes direct users affected by the disabled-service bug to build 101.26042.0011. The separate FIPS installation problem is fixed in version 101.26052.0011 and later.

Microsoft Defender for Endpoint on Linux protects server workloads on-premises and in the cloud. According to Microsoft, “it helps you prevent, detect, investigate, and respond to advanced threats with unified visibility through the Microsoft Defender portal.”

Other endpoint security platforms are available, but where an organization has gone all-in with Microsoft, the unified management offered by Defender for Endpoint on Linux can be difficult to resist.

Microsoft has an unfortunate habit of shipping broken updates for its flagship operating system, Windows. An update that breaks software specifically designed to protect a device takes things to another level, particularly given the relentless rise in attacks and the need to both fend them off and monitor activity. Hence the appeal of unified visibility through the Microsoft Defender portal.

However, an update that could leave Defender disabled after a reboot – while also refusing to install on some security-hardened systems – is less than ideal. ®

Compare Our Picks

Others We Tested

Photograph: Molly Higgins

Riccar Gem Handheld Vacuum With Tools for $70: This model is very similar to the Simplicity corded model above, and although it’s portable and handheld, this big boy needs to be plugged in for power. I like how basic it is: It just has a top switch for on/off, and a button on top to release the dust canister, which is at the front of this model rather than behind. Once disengaged, you just need to pull up the semi-spherical fabric mesh filter and dump out debris. Unfortunately, lots of fur and dust get stuck to the filter, so you’ll need to make sure you wipe it with a semi-damp cloth to clean. It comes with several attachments, including a bendy hose, long crevice nozzle with detachable brush, upholstery brush, and dusting brush. Instead of twisting or snapping, each attachment fits snugly into the opening, making it easier for those with fine-motor issues. I liked that the long, flexible hose reached easily into tight spaces like between my counter and fridge and behind my automatic litter box. The corded machine is loud and gets hot quickly due to its sheer power. While I don’t think this is the best handheld vac for everyone, it’s a solid option with lots of power.

Photograph: Molly Higgins

Tineco Go Mini Cordless Hand Vacuum for $200: A lightweight vacuum that’s fairly straightforward and charges through the end of the handle, the Tineco Go must charge for five to six hours before use, which gets you 10 to 20 minutes of use time. The main things I wanted to focus on cleaning in my everyday life were cat litter and pet hair. This vacuum spit out roughly 80 percent of the litter I tried sucking up, and the pet hair just sort of rolled around on the carpet rather than being sucked back into the vac. (I’m not sure if it was the angle or shape of the mouth that aided in both of those problems.) The suction wasn’t as powerful as others tested, and it tended to work best on hard surfaces. This vac wasn’t bad, per se, but others on this list at similar price points worked a lot more effectively on a lot more various surfaces (with multiple head attachments) than this was seemingly capable of.

Photograph: Molly Higgins

Bissell AeroSlim Handheld Vacuum for $45: Not the most powerful I’ve tested, but it’s lightweight and super easy to maneuver. It comes with a multi-accessory tool that combines a long, slim crevice tool with a moveable brush (the brush moves up and down on the tool depending on need), but you can also just use the vac without the slim attachment for more general surface cleaning. The tiny 0.1-liter front of the vac twists off to empty, and a small dual filter can also be removed for cleaning/replacement. When testing, I wasn’t able to successfully pick up bigger items like wood shards or litter, and only picked up a fraction of pet hair as some of the more powerful models with a roll brush, but I wasn’t expecting it to—that’s not this cutie’s job. It’s light, simple, and easy to use—making it a great lightweight portable option (just don’t expect it to handle bigger messes).

Photograph: Molly Higgins

Hoto AutoCare Air Duster & Vacuum for $60: Looking for a lightweight (0.78 pounds) vacuum that can also blow debris/dust, inflate and deflate, and vacuum-seal? The Hoto may be a fit. It has tons of attachments: a pointed crevice nozzle, dust brush, dust cup nozzle, air nozzle, and swim ring nozzle. It can hold a little over 3 ounces, has 20,000 Pa suction, and each attachment easily twists off and on. I found that the grooming brush head tended to push around fur/hair rather than sucking it up. Like many gadgets we test here at WIRED, this one fell into the pitfall of trying to do a lot of things, rather than doing any one thing really well. This is a great deal for a device with so many capabilities (if that’s what you need), but if you’re just looking for a really great handheld vacuum, there are others that are more effective.

Photograph: Nena Farrell

Black and Decker Dustbuster Flex for $74: WIRED reviewer Nena Farrell thought this cordless handheld vacuum was great for cars and hard-to-reach spots because of its 4-foot hose. It has a crevice tool and pet hair brush attachments for a variety of messes, and runs on a 20-volt lithium-ion battery that delivers high suction power. Plus, it has a handy charging mount that the accessories clip into. However, we aren’t fans of the short 15-minute battery life.

FAQs

Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.

Q&M Dental Group is eyeing 300 clinics with a S$146M expansion plan

If you’ve walked around Singapore long enough, you’ve probably seen one: a neighbourhood dental clinic with bright green lettering and a giant tooth logo.

Chances are, you never thought much about it. But behind those familiar storefronts sits a SGX-listed company worth over S$500 million, operating 110 clinics across Singapore and now pursuing acquisitions in Australia, Thailand, China, and even of another local rival.

That company is Q&M Dental Group—and after nearly three decades of quietly dominating Singapore’s heartlands, it’s now betting big on becoming a regional dental giant.

Built for the heartlands

Q&M was established at Bukit Batok in Nov 1996 by Dr Ng Chin Siau, an NUS dental surgery graduate who had worked as a Dental Officer with the Ministry of Health before joining a private clinic at Bukit Batok—and eventually buying it over after selling his three-room Clementi flat for S$180,000. 

From the outset, Dr Ng had little interest in building a premium dental brand. Instead, he focused on something far more scalable: providing affordable dental care to everyday Singaporeans.

That philosophy was even reflected in the company’s original Chinese name, “全民” (Quan Min), meaning “for all the people.”

Demand grew quickly and outpaced what one dentist could handle.

By 1998, fellow dentist Dr Ng Jet Wei had joined the practice. A year later, together with Dr Chong Kai Guan, the trio had opened another four clinics. By 2000, Q&M was already operating 10 clinics with 20 dentists.

Rather than chasing prime shopping malls or affluent districts, Q&M planted its clinics where Singaporeans actually lived—in HDB estates, neighbourhood centres, and suburban malls.

The strategy was simple: keep prices accessible, expand steadily, and acquire smaller dental practices whose dentists and patient bases came as part of the deal.

Along the way, Q&M also built supporting businesses, including its own dental laboratory to produce crowns, bridges, and dentures in-house, giving it greater control over costs and operations.

By the time the company listed on the SGX Mainboard in 2009, it already had a proven expansion playbook. The IPO simply gave it the capital to execute it at a much larger scale.

Building the Q&M empire

In the years that followed the IPO, Q&M expanded aggressively through acquisitions, and revenue climbed from roughly S$60 million to S$155 million by 2016. 

By then, its outlet count had grown to 76 clinics across Asia—a number that would nearly double over the following decade.

This brought Q&M Dental Group’s market capitalisation to S$557.6 million that year.

Q&M’s growth has not been limited to opening more outlets. Alongside the clinic network, the group has built a set of adjacent capabilities that reinforce the core business.

In 2019, it launched the Q&M College of Dentistry at City Square Mall—Singapore’s first private postgraduate diploma programme in clinical dentistry, designed to train general dentists with an expanded range of advanced skills. The college earned a full four-year EduTrust certification from Feb 2026, allowing it to enrol international students. 

This is a crucial move with Singapore’s dentist supply constraint. Singapore’s only domestic dental school graduates around 50 to 60 dentists per year, and foreign-trained dentists must pass a rigorous licensing exam before practising. Any competitor trying to build a rival chain faces the same thin talent pool. 

Q&M’s training college gives it a head start in sourcing and retaining the practitioners it needs to keep opening clinics, a structural advantage that competitors cannot easily replicate.

When COVID-19 hit, Q&M pivoted part of its operations, acquiring Acumen Diagnostics to distribute test kits and run laboratory PCR testing in 2021—a business that briefly became a significant revenue contributor before demand evaporated as the pandemic receded.

As pandemic revenues evaporated, results retreated sharply in 2022 and 2023. But the core dental business proved its resilience: core healthcare EBITDA held steady at around S$37 to S$40 million throughout, even as the group-level numbers were distorted. By FY2025, the group had returned to profit, recording a16% growth.

In 2023, it opened a Free Dental Clinic at Chai Chee Road, offering essential dental treatment at no cost to underprivileged patients. While charitable in nature, the initiative also reinforces Q&M’s standing in the communities where its business is most deeply rooted.

More recently, Q&M has turned its attention to technology.

In 2024, the group invested in EM2AI, a dental technology firm developing AI-powered diagnostic and treatment-planning tools, including a cloud-based practice management system called EM2Clinic.

The tools are designed to reduce the administrative burden on dentists and standardise clinical workflows, which is useful as Q&M grows toward a network where consistency across hundreds of clinics matters more than before.

Why scale matters

With 110 clinics, Q&M operates roughly 8% of Singapore’s nearly 1,300 licensed dental clinics. According to the company, it also serves around one-third of all patients who visit private dental groups.

That scale creates advantages that go beyond simply having more outlets.

As Singapore’s largest private dental chain, Q&M has greater bargaining power with landlords and suppliers, while its size also allows it to spread fixed costs across a much larger network.

Government healthcare policies could further strengthen that position.

The enhanced Community Health Assist Scheme (CHAS) subsidies introduced in Oct 2025 expanded coverage for restorative dental procedures and extended eligibility to 1.7 million cardholders. As the country’s largest CHAS-accredited private dental chain, Q&M stands to benefit more than smaller competitors. Analysts estimated the changes lifted the group’s revenue by around 3% in the second half of FY2025.

More support is also on the way. From mid-2026, seniors will be able to use up to S$400 a year from Flexi-MediSave for dental treatment at CHAS clinics. The policy aligns neatly with Singapore’s ageing population, with one in four residents expected to be aged 65 or older by 2030. As dental needs typically increase with age—and many seniors live in the heartland estates where Q&M has built its network—the demographic trend could provide another long-term tailwind for the group.

Meanwhile, Q&M continues to consolidate its position. In Mar, the group announced plans to fully acquire an unnamed Singapore dental chain, backed by a profit guarantee of up to S$34 million over five years. The deal would further strengthen its presence in its home market even as it looks overseas for growth.

Now betting big on the region

For most of its history, Q&M’s overseas ambitions effectively stopped at the Causeway.

Over the years, the group steadily expanded its presence in Malaysia, where it now operates 38 dental clinics alongside a dental supplies and equipment distribution business. Beyond that, however, its growth remained largely concentrated in Singapore.

That is now changing.

In recent months, Q&M has unveiled plans to enter three markets almost simultaneously, marking the group’s most ambitious expansion programme to date

The biggest move is Australia. In Jul 2026, Q&M signed binding agreements to acquire Experteeth Group for A$119.64 million (S$107.83 million). The deal would add 40 clinics and around 120 dentists across New South Wales, Victoria, Queensland, Tasmania, and the Australian Capital Territory, making it Q&M’s largest acquisition ever and its first entry into a market outside Asia.

In Thailand, it signed a deal to acquire a group of 30-plus clinics focused on cosmetic and aesthetic dentistry, a sector closely tied to the country’s medical tourism industry. 

In total, the acquisitions in both countries will amount to a combined US$113.2 million (S$146.26 million) investment to build a pan-Asian dental company. 

China forms the third pillar of Q&M’s expansion strategy. The group also owns Chinese dental operator Aoxin Q&M, which it has now fully consolidated as a subsidiary. It plans to use the business as a platform to acquire dental chains in southern China, expanding beyond Aoxin’s traditional base in the country’s northeast.

If all three acquisitions close, Q&M’s footprint could grow from over 160 dental outlets today to more than 300 within two years.

Not every growth initiative, however, has gone according to plan.

In Apr 2025, the group also proposed a secondary listing on Bursa Malaysia, which would have given Malaysian investors direct access to the stock and strengthened Q&M’s capital markets presence in its second-largest operating market. The plan was later shelved, with the company citing prevailing market conditions.

What could go wrong?

Three concurrent acquisitions in markets Q&M has limited or no experience operating in are an ambitious programme for a management team whose track record has been built almost entirely in Singapore and Malaysia. 

China is the cautionary tale here. Q&M first entered China back in 2013, and later spun that business off as a separately listed company, Aoxin Q&M, in 2017. Aoxin broke even for its first couple of years, then racked up losses for several years running—around RMB142 million (S$27.09 million) in total losses from 2020 to 2024—as it battled COVID-19 shutdowns and China’s strict lockdown policies.

It only turned a profit again in 2025, roughly six years after the losses began.

Now Q&M has folded Aoxin fully into its own accounts, and in doing so has added S$77.0 million of goodwill to its balance sheet—essentially the premium it’s paying on the bet that these businesses will earn enough in future to justify the price.

If they don’t, that goodwill may eventually need to be written down, hitting profits the same way it did for Aoxin’s own past investments. Australia and Thailand are brand-new markets for Q&M with no comparable track record to lean on, so if that expansion underperforms, the money put into it may not pay off.

Dental practices are also relationship-driven businesses, where patients follow their dentist, not the brand. When a chain acquires a clinic, the real asset is the practitioners inside it. 

If key dentists leave post-acquisition and take their patient books with them, the acquired revenue can evaporate quickly. 

Q&M has tried to address this through 15-year service agreements and long lock-up equity arrangements with acquired dentists, but such structures have never been tested at the scale Q&M is now attempting across four markets simultaneously.

Then there is the Johor-Singapore dynamic complicating profits further. The Rapid Transit System Link scheduled to open in Dec 2026, will cut the Woodlands North to Bukit Chagar crossing to around five minutes—at a fare of roughly S$5 to S$7.

Singaporeans already save 50 to 65% on identical dental procedures by crossing the Causeway, with more than 100,000 estimated to make the trip annually. A single dental implant costs S$4,500 to S$6,500 in Singapore versus S$1,200 to S$2,000 in Johor Bahru. 

When the RTS removes the main friction, being the border queue, from that equation, the maths for price-sensitive patients shifts meaningfully. 

Q&M’s 38 Malaysian clinics, including in Johor, might mean some of that outflow stays within the group. But how much of Q&M’s dental revenue holds up once the crossing becomes as easy as taking the MRT is a question nobody can fully answer yet.

From a single clinic in Bukit Batok to a listed group eyeing four countries simultaneously, Q&M’s story is, in many ways, a study in patience. Three decades of unglamorous, heartland dentistry have built toward a moment where the company is finally ready to bet big on becoming Singapore’s dominant private dental chain in the region. Whether the bet pays off will be the next chapter.

• Learn more about Q&M Dental Group here.
• Read other articles we’ve written on Singaporean businesses here.

Also Read: ⁠The price of going regional: Raffles Medical’s S$600M bet is still struggling to pay off

Featured Image Credit: National University of Singapore, Velocity @ Novena Square