Alliance Medinet Breach Exposes Data of About 110,000 Singapore Members

Personal data of about 110,000 members of Alliance Medinet, a Singapore managed-healthcare provider, was accessed by an unauthorised third party, CNA reported on 24 October. Names, ID numbers and contact details were exposed, along with the bank account details of seven members and one member's diagnosis. The Straits Times reported that dates of birth, policy details and employment information were also exposed.

The parent company, Alliance Healthcare Group, posted a cyber incident update on the Singapore Exchange on 26 October. In it, CNA reported, the group said KPMG had validated the fixes and that "the unauthorised access path used by the third party" had been secured, with no evidence of further compromise. The board said the breach was limited to Medinet's membership database and that the group's financial systems weren't affected, according to The Straits Times. The group has also engaged external legal counsel on the incident.

Where Medinet sits

Medinet is the group's corporate healthcare arm. Set up in 2005, it runs managed-care plans and third-party claims administration through a panel of more than 2,000 clinics.

Insurers' counts

Insurers gave counts for their own customers to The Straits Times:

• Tokio Marine: 6,103 people, which it said was about 6% of all affected members.
• HSBC Life: 2,614 individual and 1,381 group policyholders.
• Singlife: 323.
• Income: about 70.
• Great Eastern: bank information of three members.
• Cigna: one person's health data.

AIA, Prudential and Liberty said their customers weren't affected.

Regulators

Medinet notified the Personal Data Protection Commission on 21 October. On 24 October the PDPC said it is investigating, and the Cyber Security Agency of Singapore said it is "monitoring developments closely".

The company hasn't said when the intrusion happened or when it was found.