Dementia Singapore CARA App Data Breach May Have Exposed Members' Names, Emails and Phone Numbers

Personal data of some members of CARA, Dementia Singapore's app with Safe Return and missing-person alerts for people with dementia and their caregivers, may have been exposed in a cybersecurity incident on 1 November. The charity told members by email on 11 November that it found out when unauthorised notifications were sent to them through the platform. It hasn't said how many members are affected or what those notifications said.

What was exposed

The email lists names, email addresses, phone numbers and membership IDs as potentially exposed, and says "No NRIC numbers were compromised".

Containment and the PDPC report

Dementia Singapore says its third-party mobile app service provider has contained the incident and is securing its systems; the provider isn't named, and the two are still working out how far the incident went. The charity has reported it to the Personal Data Protection Commission. The Straits Times asked the PDPC and the Cyber Security Agency for comment, and its report carries no reply.

Other Singapore health incidents this month

Minmed disclosed an attack on its teleconsultation and screening system on 11 November too. Fullerton Health posted its notice on 9 November about a server attack that exposed migrant workers' FIN numbers, and Doctor Anywhere disclosed its breach of users' personal data on 6 November.

What members are told to do

Members can keep using the CARA SG app but should update it to the latest version from the App Store or Google Play. Dementia Singapore asks them to treat unexpected emails, calls and messages claiming to come from it or CARA with suspicion, and not to click suspicious links, download unexpected attachments or share passwords and one-time passwords. Any unusual request for personal details or payment should be checked with the charity directly, on 6377-0700 or at [email protected] and [email protected].