Singapore’s Ministry of Health identified unauthorized access at six health-related entities as the cyber agency reported incident reports averaging triple the earlier monthly pace, amid a wider global trend of opportunistic attacks.
In its Nov. 12 statement, MOH named the Agency for Integrated Care’s Advance Care Planning IT system; systems belonging to Alliance Medinet, Doctor Anywhere Group, Fullerton Health Group and Minmed Group; and Dementia Singapore’s CARA mobile app. The ministry said patient care had not been interrupted and that it had found no indication so far of compromised patient safety. To its knowledge, patient health records had not been accessed, MOH said, while adding that its review with the affected entities was continuing.
CSA said in a Nov. 13 advisory that reported incidents since September averaged three times the monthly level from January through August. The agency said the recent attacks appeared opportunistic, rather than coordinated campaigns targeting Singapore, and fit a wider global pattern. The comparison follows an earlier report on Singapore’s cyber incident levels.
Separate company disclosures described personal information that may have been involved. In an Oct. 24 filing, Alliance Healthcare Group said data in Alliance Medinet’s membership database for about 110,000 members had been compromised. Names, personal identification numbers and contact details were among the information potentially affected; bank-account information for seven members and one member’s medical diagnosis might also have been compromised. The investigation was ongoing.
Fullerton Health said it learned Oct. 31 of unauthorized access to a server supporting its Migrant Worker Primary Care Plan. Names, FIN numbers, birth dates and contact details might have been affected. The company said its preliminary review found no health, medical or personal financial information among the data that may have been involved.
Channel NewsAsia (CNA) reported Nov. 13 that six of 10 data breaches involving compromised information over the preceding two months were healthcare-related. MOH’s statement names six affected entities but does not give that broader tally. Associate Professor Razwana Begum of the Singapore University of Social Sciences told CNA that weaknesses in interconnected systems could potentially expose information held by other organizations.
CSA’s early observations cited gaps involving exposed or unpatched systems, misconfigured APIs, weak or reused passwords, missing multifactor authentication and phishing defenses. The agency also noted compromised suppliers in some incidents, without tying those findings to the named healthcare cases. It said vendor-managed services can provide a route into organizations’ networks, with successful attacks risking operational disruption, reputational damage and financial losses.
MOH directed public healthcare institutions and Synapxe to step up cyber-threat monitoring and urged private providers to strengthen their cybersecurity measures.
