No unauthorised access to patient records during recent cyberattacks in healthcare sector: MOH
The Ministry of Health (MOH) said it is taking the six recent cybersecurity incidents that have hit the healthcare sector “very seriously” and is following up on the incidents.
The breaches have not disrupted patient care operations, according to an MOH statement released on Thursday (12 Nov).
Source: Google Maps
‘No evidence’ that patient safety & care compromised: MOH
The six healthcare and healthcare-related entities whose systems have been hit by cyberattacks so far are:
- Alliance Medinet
- Doctor Anywhere Group
- Fullerton Health Group
- Minmed Group
- Dementia Singapore
- Agency for Integrated Care (AIC)
The breaches have not disrupted patient care operations, and there is “no evidence thus far” to suggest that patient safety and care were compromised, MOH said.
To the ministry’s knowledge, there was also no unauthorised access to patient health records.
MOH & affected healthcare entities following up on cyberattacks
Nevertheless, MOH is following up with the affected entities to check on the full implications of these incidents.
The entities are also following up on the incidents by working closely with their cybersecurity consultants and the relevant authorities, including the Cyber Security Agency of Singapore (CSA) and the Personal Data Protection Commission (PDPC).
On their part, CSA and PDPC issued a joint advisory on the same day, warning of cybersecurity and data protection risks with inadequately secured and monitored Application Programming Interfaces (APIs).
Source: Jakub Żerdzicki on Unsplash. Photo for illustration purposes only.
Alliance Medinet cyberattack reported on 21 Oct
The first to report a cyberattack was Alliance Medinet, with the healthcare services provider announcing the incident in a bourse filing on 24 Oct.
It involved unauthorised access to its system containing its membership database, with the personal data of approximately 110,000 members compromised by a third-party.
The data potentially leaked included names, personal identification numbers and contact information.
Worse still, seven members might have had their bank account information compromised and one member’s medical diagnosis might have been breached.
Source: Google Maps
The incident was reported on 21 Oct to the PDPC, which is conducting an investigation.
Doctor Anywhere affected by data breach on 29 Oct
Next, telemedicine provider Doctor Anywhere said on 6 Nov that it had been affected by a data breach.
The company said it became aware on 29 Oct of the “malicious cyber incident”, which involved unauthorised access by an unknown third party.
Customers’ personal data compromised included names, email addresses, identity card (IC) and passport numbers, dates of birth, emergency contact details, and bank account details.
However, it maintained there is “no evidence to suggest” the leakage of passwords, login credentials, payment card details and images of IC documents. All clinical records were also not affected.
Source: Google Maps
Migrant workers’ data leaked in Fullerton Health cyberattack on 31 Oct
On 31 Oct, Fullerton Health said it became aware of a cybersecurity incident involving unauthorised access to a server supporting its Migrant Worker Primary Care Plan (PCP) programme administered by the Ministry of Manpower (MOM).
In a statement on its website on Monday (9 Nov), it said migrant workers’ data that may have been leaked includes their full names, FIN numbers, dates of birth, phone numbers, emails, and residential addresses.
No health, medical or personal financial information was affected.
Source: Google Maps
Fullerton Health notified the PDPC, made a police report and is in contact with MOM, it noted, adding that it is cooperating fully with the relevant authorities.
Minmed reports ‘malicious’ cyberattack on 11 Nov
Minmed was the next to report a malicious cybersecurity incident on Wednesday (11 Nov).
It appeared to be limited to a “specific standalone system” supporting its teleconsultation and health screening business, with no clinical records affected, it said.
The vulnerabilities in its system were secured on 5 Nov after it engaged Ensign InfoSecurity (Singapore), an independent cybersecurity and forensic expert firm, to further strengthen the systems.
It also reported the incident to the PDPC and made a police report.
Source: Google Maps
Dementia S’pore app sends unauthorised notifications
Subsequently, Dementia Singapore said on the same day that unauthorised notifications had been sent to users of its lifestyle and community digital app CARA.
It then found that members’ personal info was potentially exposed, including names, e-mail addresses, phone numbers and membership IDs, but no NRIC numbers were compromised.
Its third-party mobile app service provider took immediate steps to contain the situation and secure its systems. The incident was also reported to the PDPC.
Source: Dementia Singapore on Facebook
AIC reports cyberattack on same day as MOH statement
Lastly, AIC reported a cybersecurity incident on the same day as MOH’s statement.
This latest attack was detected on Tuesday (10 Nov) and affected its Advance Care Planning (ACP) information technology system.
The personal data of up to 4,064 employees from public healthcare institutions and community care providers may have been accessed by a third party, including names, contact numbers, email addresses and NRIC numbers.
But there are no indications that medical records or patient data were compromised, AIC said.
MOH reminds agencies & institutions to stay vigilant
MOH said it had asked national healthtech agency Synapxe and the public healthcare institutions to stay vigilant and increase monitoring for potential cyber threats across public healthcare IT systems.
Private healthcare providers should review and strengthen their cybersecurity measures to protect their systems and information against such attacks, it noted.
The ministry said the incidents “underscore the importance of being vigilant”, adding that despite the best efforts, “every IT system is vulnerable to the most determined attack”.
It reminded all licensed healthcare institutions and system providers to remain vigilant, strengthen their cybersecurity posture, and ensure the security and integrity of their IT assets, systems, and patient data.
Besides healthcare entities, companies like SPH Media, M1 and Singapore Airlines have also been hit by cyberattacks in recent days.
Also read: SPH Media sustains cyberattacks, but reports no sensitive financial information compromised
SPH Media sustains cyberattacks, but reports no sensitive financial information compromised
Have news you must share? Get in touch with us via email at news@mustsharenews.com.
Featured image adapted from Google Maps and Jakub Żerdzicki on Unsplash. Photo on the right for illustration purposes only.
