Minmed Group, a Singapore health care provider, said malicious activity affected a separate platform used for remote consultations and screenings; its clinical records were unaffected, and services continued to operate.
The company has not disclosed whether other personal data was accessed or affected, how many people might be involved or when it discovered the incident. Minmed said its review was still underway and that it could not provide further details.
Minmed said it took steps to contain the incident and engaged Ensign InfoSecurity to investigate. The company said Ensign had independently assessed the security repairs by Nov. 5 and confirmed that identified vulnerabilities were secured. Minmed also said it notified Singapore’s Personal Data Protection Commission (PDPC) and filed a police report.
The reported security work predates Minmed’s public disclosure on Nov. 11. The company has not said when it found the incident or explained the timing. Minmed also operates general-practice, dental and pediatric clinics.
The disclosure followed an Income Insurance notice on Nov. 6 about unauthorized access to a Doctor Anywhere system. Income Insurance said Adept Health notified it of the access on Nov. 2 and that there was no evidence medical records had been accessed.
Fullerton Health said in a Nov. 9 notice that it learned on Oct. 31 of unauthorized access to a server used for its Migrant Worker Primary Care Plan. The company said personal data belonging to migrant workers might have been affected.
The notices concern different systems, and the statements do not establish a connection among the three incidents. Minmed’s investigation is continuing, with no completion date announced.
