Singapore sees string of cybersecurity incidents involving healthcare-related agencies
Personal data of more than 4,000 employees of public healthcare institutions and community care providers may have been compromised in a cybersecurity incident involving the Agency for Integrated Care (AIC) in Singapore.
The AIC said on Thursday the incident affected the Advance Care Planning (ACP) information technology system, which is used by facilitators to help the public document their advance care planning, The Straits Times reported.
According to the report, the ACP IT system had been accessed by an unauthorised third party, exposing the names, contact numbers, email addresses and, National Registration Identity Card (NRIC) numbers of up to 4,064 staff of public healthcare institutions and community providers.
It noted, however, that there were no indications that medical records or patient data have been compromised, and that no other systems have been affected.
The ACP system had been taken offline on the same day while the investigations were carried out, and was restored on Thursday, according to the AIC.
The agency added that it lodged a police report on 10 November and reported the incident to the Cyber Security Agency of Singapore (CSA).
Healthcare-related incidents in Singapore
AIC is the latest healthcare-related agency to be targeted by a cyberattack in Singapore, following a series of incidents going back to late October.
On 24 October, Alliance Medinet said the personal data of about 110,000 members were compromised after unauthorised access to its membership base. This unauthorised path was later secured and validated by independent cybersecurity and forensic specialists from KPMG, Channel News Asia (CNA) reported.
On 6 November, Doctor Anywhere also reported that the personal data of its users were leaked in a cyber incident involving an unknown third party.
On 9 November, Fullerton Health reported that a server supporting its Migrant Worker Primary Care Plan programme was accessed without authorisation.
Doctor Anywhere and Fullerton Health did not disclose how many individuals may have been affected, but the latter said names, Foreign Identification Numbers (FINs), dates of birth and contact details may have been exposed, according to the CNA report.
On 11 November, Singapore reported two cybersecurity incidents involving Dementia Singapore's CARA SG app and the Minmed Group.
CARA SG members' personal data, including their names, email phone numbers and membership IDs, may have been compromised after the cybersecurity incident saw unauthorised app notifications sent on 1 November.
For Minmed Group, a standalone system supporting its teleconsultation and health screening services was hit by a "malicious cybersecurity incident."
It also did not disclose the number of affected individuals, but assured that clinical records were not compromised, according to CNA.
Health Ministry's reaction
Singapore's Ministry of Health (MOH) said in a statement on Thursday that it is taking the string of cybersecurity incidents in the healthcare sector "very seriously."
"These incidents underscore the importance of being vigilant and despite the best of efforts, every IT system is vulnerable to the most determined attack," MOH said.
"With the advancement of technology, especially AI, vulnerabilities will be easily exposed and cyberattacks more frequent, rapid and formidable."
MOH added that the recent breaches have not disrupted patient care operations, and there is no evidence suggesting that patient safety and care had been compromised.
"To our knowledge, there had not been unauthorised access of patient health records in these breaches. Nevertheless, MOH is following up with the affected entities to check on the full implications from these incidents," the ministry said.
It said it is now working closely with cybersecurity consultants of the affected entities, and the relevant authorities, including the CSA and the Personal Data Protection Commission, to follow up on the incidents.
"MOH reminds all licensed healthcare institutions and Healthcare Information Management System providers to remain vigilant, strengthen their cybersecurity posture, and ensure the security and integrity of their IT assets, systems, and patient data," it added.
