Singapore MOH Confirms Cybersecurity Incidents at Six Healthcare Bodies, AIC System Exposes NRICs of Up to 4,064 Staff

Singapore's Ministry of Health has confirmed that six healthcare organisations had their systems accessed without authorisation, and says that to its knowledge no patient health records were reached. The newest of the six is the Agency for Integrated Care (AIC), whose Advance Care Planning system held the names, phone numbers, email addresses and NRIC numbers of up to 4,064 employees of public healthcare institutions and community care providers.

The six organisations

MOH's statement of 12 November lists the AIC system alongside Alliance Medinet, Doctor Anywhere Group, Fullerton Health Group, Minmed Group and Dementia Singapore's CARA app. The other five had already disclosed their incidents. Alliance Medinet reported a breach of its membership database in October, and Fullerton Health's attack exposed migrant workers' FIN numbers and addresses. Minmed's teleconsultation and screening system was hit. The CARA app leaked members' contact details, while Doctor Anywhere said users' personal data leaked but clinical records didn't.

The ministry says there is no evidence so far that patient safety and care were compromised. It gives no total for the people affected across the six.

What happened at AIC

AsiaOne reports the AIC breach was detected on 10 November. AIC made a police report and told the Cyber Security Agency the same day. While the system was offline, facilitators recorded patients' care preferences on paper, until AIC restored access on 12 November.

What MOH has ordered

The ministry has asked Synapxe, which runs public healthcare IT, and the public hospitals to increase monitoring for cyber threats across public healthcare IT systems. It tells private providers to review and strengthen their own defences, and warns that as technology, especially AI, advances, vulnerabilities will be "easily exposed". MOH is working with the affected organisations' consultants and with the Cyber Security Agency and the Personal Data Protection Commission.

What AIC tells affected staff

AIC will contact everyone potentially affected within three days. It asks them to treat unsolicited emails, messages and calls with suspicion and not to share personal information, passwords or one-time passwords. Questions go to its hotline, 1800-650-6060, or [email protected].