Alliance Medinet says access path used in data breach has been secured

SINGAPORE: The unauthorised access path used in a cyber incident involving Alliance Medinet has been secured, with no evidence of further compromise to its information system, parent company Alliance Healthcare Group said.

In a bourse filing on Monday (Oct 26), the group said independent cybersecurity and forensic specialists from KPMG had validated the security fixes implemented by Medinet's IT team.

Alliance Medinet is the corporate healthcare arm of Alliance Healthcare Group, specialising in managed healthcare services and third-party administration services.

KPMG also confirmed that the unauthorised access path used by the third party had been secured.

Investigations remain ongoing to establish the cause, full extent and circumstances of the incident.

Alliance Medinet is the corporate healthcare arm of Alliance Healthcare Group, specialising in managed healthcare services and third-party administration services.

The personal data of about 110,000 members was compromised in the incident, which involved unauthorised access to Alliance Medinet's membership database. 

Customers of insurers HSBC Life, Income Insurance and Singlife were among those affected.

The three insurers said nearly 4,400 of their customers were affected or potentially affected by the breach.

The compromised information potentially includes names, personal identification numbers and contact details, Alliance Healthcare Group said in an earlier bourse filing on Saturday.

It also said bank account information belonging to seven members and one member's medical diagnosis might have been compromised.

Alliance Healthcare Group said on Monday that it had also engaged external legal counsel to advise and assist on the incident.

The company said it has implemented enhanced, continuous monitoring of network connectivity, databases, and servers. 

Alliance Medinet is reviewing the incident and its IT systems to ensure that it remains robust and the "data it is entrusted with remains safe and secure". Both companies will continue to maintain heightened vigilance against potential threats.

"Medinet remains focused on ensuring business continuity, supporting affected stakeholders and implementing further cybersecurity enhancements as part of its ongoing response to the incident," Alliance Healthcare Group said.

The company reiterated that the incident was confined to the system containing Medinet's membership database.

Its other systems, including financial systems, were not affected, while the rest of the group continues to operate normally.

Alliance Healthcare Group said it will continue to keep shareholders updated on any material developments in relation to the incident, "including the financial and operational implications which are being evaluated", with the full extent yet to be determined.

The company also advised shareholders to exercise caution when dealing in its shares or securities and to seek professional advice where necessary.