No further compromise to Alliance Medinet’s system, hacker access blocked, says parent company

SINGAPORE – The cybersecurity breach into healthcare services provider Alliance Medinet’s membership database has been contained, with no further compromise detected across its information system, its parent company said on Oct 26.

The announcement follows a Oct 24 disclosure that about 110,000 members had their personal data compromised in a cyber incident involving unauthorised access to Alliance Medinet’s database.

In an update to shareholders on Oct 26, parent company Alliance Healthcare Group said it has appointed KPMG Services as independent cybersecurity and forensic specialists to look into the incident.

“As at the date of this announcement, KPMG has validated the security fixes deployed by Medinet’s IT team and confirmed that the unauthorised access path used by the third party has been secured,” the group’s board said in its statement.

“At this point, there is no evidence of further compromise to Medinet’s information system.”

The board said KPMG will continue the investigation to determine the root causes, extent and impact of the incident.

In the update, the board said the data breach was limited to Alliance Medinet’s membership database. The group’s other systems, including its financial systems, were not affected by the breach.

Alliance Medinet – the corporate healthcare arm of Alliance Healthcare Group – specialises in managed healthcare services, offering personalised corporate healthcare solutions and third-party administration services, according to its website.

The subsidiary was established in 2005 and has a network of more than 2,000 panel clinics in Singapore.

Cigna, Great Eastern, HSBC Life, Income Insurance, Singlife and Tokio Marine, which Alliance Medinet provides services to, were among those affected by the data breach.

According to the company, data potentially exposed in the breach included members’ full names, personal identification numbers, birth dates, contact information, policy details and employment information.

In a bourse filing on Oct 24, Alliance Healthcare Group said the bank account information of seven members in the database and one member’s medical diagnosis might also have been compromised.

In response to media queries, the Cyber Security Agency (CSA) of Singapore had earlier said it was monitoring developments closely, while the Personal Data Protection Commission (PDPC) said it was investigating the incident.

The Straits Times has reached out to CSA and PDPC for more information.