Records of about 140,000 migrant workers exposed in Fullerton Health's recent data breach

SINGAPORE: About 140,000 work pass holder records were compromised in the cybersecurity incident involving Fullerton Health's Migrant Worker Primary Care Plan (PCP) programme that was first disclosed earlier this week, the healthcare provider said on Saturday (Nov 14).

Of those, about 43,000 records belonged to individuals whose work passes were no longer valid, Fullerton Health said in response to CNA queries.

“No health, medical or personal financial information was compromised in the incident,” it said.

Fullerton Health had said in a Nov 9 notice on its website that it became aware of the breach on Oct 31, without disclosing the number of workers affected at the time.

Preliminary investigations showed that migrant workers' full names, foreign identification numbers, dates of birth, mobile numbers, email addresses and residential addresses may have been affected.

Fullerton Health said in its latest response to CNA that its security monitoring provider, Logicalis, found no evidence of abnormalities or security breaches across the Fullerton Health IT assets under its monitoring, based on the provider's preliminary probe.

The company said it promptly isolated the affected server supporting the PCP programme after discovering the incident and implemented precautionary measures across its network to secure its systems.

“As part of our remediation efforts, we are building an entirely new server, with security measures in place from the outset, to serve as a new PCP Enrolment Portal,” it said.

This ensures the affected server will not be reused, the health provider said.

“Fullerton Health employs a defence-in-depth security strategy, incorporating multiple layers of controls to safeguard our assets and data,” it added.

“We will continue to monitor the threat landscape for continuous improvement to our security posture.”

The company said it has made two rounds of notifications to affected migrant workers through their employers.

Fullerton Health advised the migrant workers to exercise caution when responding to unsolicited emails, phone calls, text messages or other communications requesting personal information.

The Ministry of Manpower (MOM) has also notified affected workers directly through its FWMOMCare mobile application for migrant workers.

The PCP programme is administered by MOM.

The mobile application notifications were provided in workers' native languages to help ensure affected workers understand the situation and the precautionary measures they should take, Fullerton Health noted.

Recent healthcare data breaches

Oct 24: Alliance Medinet

Personal data of about 110,000 members was compromised after unauthorised access to its membership database, including names, identification numbers and contact details. Bank details of seven members and one member’s medical diagnosis might also have been affected. Nearly 4,400 customers of HSBC Life, Income Insurance and Singlife were affected or potentially affected.

Nov 6: Doctor Anywhere

Users’ personal data was leaked in a cyber incident involving an unknown third party. Doctor Anywhere, which became aware of the breach on Oct 29, did not disclose how many users or what data were affected, but said clinical records were not compromised.

Nov 9: Fullerton Health

A server supporting its Migrant Worker Primary Care Plan programme was accessed without authorisation. Fullerton Health said on Nov 14 that 140,000 work pass holder records were affected, of which about 43,000 records belonged to individuals whose work passes were no longer valid. While names, foreign identification numbers, dates of birth and contact details may have been exposed, it said health, medical and financial information were not affected.

Nov 11: Dementia Singapore’s CARA SG app

Some CARA SG members’ personal data may have been compromised after a cyber incident that saw unauthorised app notifications being sent on Nov 1. Names, email addresses, phone numbers and membership IDs may have been affected, but no NRIC numbers were compromised.

Nov 11: Minmed Group

A standalone system supporting Minmed’s teleconsultation and health screening services was hit by a “malicious cybersecurity incident”. The group did not disclose the number of people or types of personal data affected, but said clinical records were not compromised.

Nov 12: Agency for Integrated Care (AIC)

An unauthorised third party accessed AIC’s Advance Care Planning IT system, potentially compromising the personal data of up to 4,064 staff members from public healthcare institutions and community care providers. Names, contact details and NRIC numbers may have been affected, but no indications were found that medical records or patient data had been compromised.

Collapse Expand

STRING OF DATA BREACHES

Fullerton Health’s cybersecurity incident follows several recent reported data breaches involving healthcare entities and other organisations, including M1, Singapore Airlines and SPH Media.

Affected healthcare entities include the Agency for Integrated Care (AIC), Alliance Medinet, Doctor Anywhere Group, Minmed Group and Dementia Singapore.

The Personal Data Protection Commission (PDPC) on Friday said the recent spate of data breaches appears to have been the result of opportunistic attacks, with no clear connection between them.

Preliminary indications were that the recent “significant data breaches” reported resulted from opportunistic attacks exploiting common vulnerabilities in IT systems, the commission said.

Some were also related to global data breaches, it added.

The Cyber Security Agency of Singapore (CSA) on Friday also noted the average monthly number of reported cyber incidents since September has been three times the January to August average, but they do not appear to be part of coordinated campaigns targeting Singapore.

Instead, these incidents reflect "a broader global trend of opportunistic attacks", it said.

CSA said it has briefed all critical information infrastructure (CII) sectors and is working closely with CII owners to strengthen cyber defences.

The CII sectors are: energy, water, banking and finance, healthcare, transport, infocomm, media, security and emergency services, and government.