140,000 migrant worker records hit in Fullerton Health cyber breach; new server planned

SINGAPORE - About 140,000 work pass holder records were compromised in a recent cybersecurity incident involving a Fullerton Health portal, though no health, medical or personal financial information was affected.

The breach involved unauthorised access to a standalone server supporting the healthcare provider’s Migrant Worker Primary Care Plan (PCP) programme, with data such as full names, foreign identification numbers, dates of birth, mobile numbers, e-mail addresses and residential addresses potentially exposed.

Of the compromised records, about 43,000 belonged to individuals whose work passes are no longer valid, Fullerton Health Group (FHG) and the Ministry of Manpower (MOM) said in separate statements on Nov 14.

FHG, one of four anchor operators appointed by MOM to administer the PCP for migrant workers, notified the ministry of the breach on Nov 2, and alerted the public to the incident on Nov 9.

The healthcare service provider said then that it became aware of the cyber incident on Oct 31.

In a reply to queries from The Straits Times, FHG said on Nov 14 that it promptly isolated the affected standalone server and implemented networkwide security measures upon discovering the breach.

As part of remediation efforts, the group is building an entirely new server from scratch with security measures embedded from the outset to host a new PCP enrolment portal.

“This approach ensures that the compromised server will not be used,” FHG said.

“We will continue to monitor the threat landscape for continuous improvement to our security posture,” it added.

Both FHG and MOM stressed that the incident has not disrupted migrant workers’ access to the PCP, and they can continue to seek medical care as usual.

The PCP is intended to provide eligible workers in Singapore with accessible and affordable healthcare.

It is mandatory for employers here to purchase a PCP for certain work permit and S Pass holders, such as those who work in the construction, marine shipyard or process sectors.

FHG has conducted two rounds of notifications through employers to alert affected workers of the breach. Workers are advised to be wary of unsolicited e-mails, phone calls, text messages or other communications requesting their personal information.

The Ministry of Manpower (MOM) has also notified affected workers directly in their native languages via its FWMOMCare mobile app to help them understand the situation and the precautionary measures they should take.

Preliminary investigations by FHG’s security monitoring provider, Logicalis, have found no evidence of abnormalities or breaches across other monitored information technology assets, the company said.

In response to media queries, MOM said on Nov 14 that it has been working closely with FHG on investigations and follow-up actions.

The ministry said it requires all PCP anchor operators and their contractors to maintain adequate data security measures to protect migrant workers’ personal data.

While no incidents have been reported by the other three operators, the ministry has reminded all operators to review their cybersecurity measures and remain vigilant.

MOH has similarly instructed national healthtech agency Synapxe and public healthcare institutions to step up monitoring across public healthcare IT systems, while urging private providers and health information system vendors to review and strengthen their defences.

“With the advancement of technology, especially artificial intelligence, vulnerabilities will be easily exposed and cyberattacks more frequent, rapid and formidable,” MOH said in a statement on Nov 12, reminding all licensed healthcare institutions to ensure the security and integrity of their systems and patient data.

The Fullerton Health breach comes amid a recent string of cybersecurity incidents involving unauthorised access to healthcare and healthcare-related entities, including the Agency for Integrated Care’s Advance Care Planning IT system, Alliance Medinet, Doctor Anywhere Group, Minmed Group, and Dementia Singapore’s CARA mobile app.

The Ministry of Health (MOH) noted that patient care operations have not been disrupted and there is no evidence so far that patient safety, care, or patient health records were compromised in these breaches.

The affected organisations are working with their cybersecurity consultants alongside the Cyber Security Agency of Singapore (CSA) and the Personal Data Protection Commission (PDPC) to follow up on the incidents, the ministry said in a statement on Nov 12.

At least 12 cyberincidents involving Singapore organisations or their service providers were reported between Oct 24 and Nov 13, according to CSA.

Six of the 12 incidents involved healthcare and community care organisations.

The other six known data breaches impacted personal finance portal MoneySmart, Singapore Airlines, telco M1, SPH Media, SATS’ Tappee meal-ordering app and local clothing label Our Second Nature.

Since September, average monthly reported cyber incidents have surged to three times the rate recorded between January and August, CSA said.

The Personal Data Protection Commission said that there is no clear connection between the incidents, with some linked to global data breaches.

It added that the observed breaches arose from attacks exploiting a range of common vulnerabilities in IT systems.