Data of 4,000 healthcare staff may have been compromised after cyberbreach of system used by AIC

SINGAPORE – Personal data of more than 4,000 staff of public healthcare institutions and community care providers may have been compromised in a cybersecurity incident involving a system used by the Agency for Integrated Care (AIC).

It is the latest healthcare-related organisation to be hit by data breaches in recent weeks.

The Ministry of Health said in a statement on Nov 12 that these breaches have not affected patient care operations.

In a statement on Nov 12, AIC said that on Nov 10, it detected that its Advance Care Planning (ACP) information technology system was accessed by an unauthorised third party.

Data such as names, contact numbers, e-mail addresses and NRIC numbers of up to 4,064 staff of public healthcare institutions and community care providers may have been accessed as a result of the cyberbreach, it said.

To date, there are no indications that medical records or patient data have been compromised, AIC said, adding that no other systems have been affected.

The agency said that investigations are ongoing.

The ACP IT system is used by ACP facilitators to help members of the public document their ACPs. These facilitators are people who are certified to conduct ACP discussions and guide users with making decisions on their future care preferences.

A police report was lodged on Nov 10, AIC said, adding that the incident was also reported to the Cyber Security Agency of Singapore.

The ACP IT System was taken offline on the same day while investigations were conducted as a precaution, AIC said, adding that it was restored on Nov 12.

During that period, ACP facilitators were advised to continue ACP documentation using physical forms, AIC said.

The agency said: “AIC is continuing to investigate the incident, and will carry out a thorough review of its systems and work with CSA to take immediate mitigating actions to strengthen its cyberdefence.”

AIC said it will contact those who might have been affected within the next three days.

Those who have been affected are advised to exercise caution should they receive suspicious and unsolicited e-mails, messages and calls.

People should also avoid sharing personal information, passwords or one-time passwords with strangers.

Additionally, those who suspect they have might have their personal information breached can contact AIC on 1800-650-6060 or e-mail enquires@aic.sg

Daniel Lai is a journalist at the ST Now team, covering breaking news and international affairs.