St. Luke’s, NPC investigating data breach on mobile app

The incident may have compromised the personal information of patients and employees, but did not affect hospital operations

MANILA, Philippines – St. Luke’s Medical Center disclosed last Thursday, October 29 that a “data security incident” affected its mobile application. The National Privacy Commission (NPC) also confirmed receipt of a personal data breach notification from St. Luke’s the following day, October 30.

In a statement, St. Luke’s — which has upscale hospitals in Quezon City and Taguig — said it “recently identified unauthorized access to its mobile application, managed by a third-party service provider.”

St. Luke’s announced on Thursday evening that it had made its eHub application unavailable “due to maintenance activities.”

In its October 30 statement, St. Luke’s said it contained the issue after isolating the app, and enlisted third-party cybersecurity experts to investigate what happened.

The incident was said to have potentially affected personal information regarding patients and employees.

The medical center said individuals — patients or employees — whose personal information may have been compromised will be “notified directly.”

It also said that “hospital operations remain unaffected.” 

“St. Luke’s sincerely apologizes for any concern this incident may cause and remains committed to protecting the privacy and security of our patients and employees,” it said. 

The NPC, meanwhile, said it is “currently reviewing the notification in accordance with established procedures for handling personal data breach notificiations.”

It added that it was unable to disclose further details —such as which application of St. Luke’s was affected by the data breach, the number of patients and employees affected, and the severity of the breach itself – until the NPC completes its evaulation.

We have reached out to St. Luke’s Medical Center’s Data Protection Office for further information and clarifications. We will update this story if we get a response. – Rappler.com