No evidence that patient safety & care compromised: MOH on cybersecurity incidents involving 6 healthcare entities - Mothership

MOH noted that the recent breaches have neither disrupted patient care operations nor compromised patient safety or electronic health records.

The Ministry of Health (MOH) has issued a call for heightened cybersecurity vigilance across the healthcare sector following a string of recent data breaches and unauthorised access incidents involving both public-linked and private healthcare entities.

In a media statement released on Thursday (Nov. 12), MOH confirmed it is taking the incidents "very seriously" and is following up with the six affected organisations to assess the full implications.

The entities named by the ministry are the Agency for Integrated Care (AIC), Alliance Medinet, Doctor Anywhere Group, Fullerton Health Group, Minmed Group, and Dementia Singapore.

While MOH noted that the breaches have not disrupted patient care operations — and that there is no evidence thus far to suggest patient safety or electronic health records have been compromised — the recent incidents highlight the vulnerabilities in IT infrastructure.

Alliance Medinet disclosed in late October that a cyber incident compromised the personal data of approximately 110,000 members, including customers of insurers HSBC Life, Singlife, and Income Insurance.

Compromised details potentially included names, identification numbers, and contact information, alongside bank account details for seven members and one member's medical diagnosis.

The firm subsequently engaged KPMG to validate security fixes.

Dementia Singapore alerted users of its CARA mobile application on Nov. 11 that an unauthorised access incident on Nov. 1 may have exposed members' names, email addresses, phone numbers, and membership IDs.

Doctor Anywhere Group said on Nov. 6 that an unknown third party had gained unauthorised access to its systems, resulting in a leak of users' personal data.

Forensic investigations by Ensign InfoSecurity indicated that clinical records were unaffected.

On Nov. 9, Fullerton Health Group revealed that a server supporting its Migrant Worker Primary Care Plan (PCP) programme had been accessed without authorisation.

Exposed data potentially included workers' names, Foreign Identification Numbers (FIN), dates of birth, and contact details, though no medical or financial data was stored on the server.

Just a day before MOH's statement, Minmed reported a "malicious cybersecurity incident" affecting a standalone system used for teleconsultations and health screenings.

Clinical records remained intact, and the group engaged Ensign InfoSecurity while filing reports with the police and regulators.

AIC announced on Nov. 12 that its Advance Care Planning (ACP) IT System was accessed two days prior by an unauthorised third party.

The personal data of up to 4,064 employees of public healthcare institutions and community care providers may have been accessed as a result.

The data affected comprises names, contact numbers, email addresses, and NRIC numbers.

The agency said there are no indications that medical records or patient data have been compromised and no other systems have been affected.

The affected organisations are working alongside external cybersecurity consultants, the Cyber Security Agency of Singapore (CSA), and the Personal Data Protection Commission (PDPC) to investigate and contain the breaches.

In response to the cluster of incidents, MOH has instructed Synapxe — the national healthtech agency — and public healthcare institutions to step up threat monitoring across public IT networks.

It also urged private healthcare providers and Health Information Management System (HIMS) vendors to urgently review and fortify their digital defences.

The ministry warned that the rapid evolution of technology, particularly artificial intelligence (AI), is lowering the barrier for threat actors to expose system vulnerabilities, making cyberattacks "more frequent, rapid and formidable".