Fullerton Health server hit by cyberattack; personal data of migrant workers affected

SINGAPORE – A server supporting Fullerton Health’s Migrant Worker Primary Care Plan (PCP) programme was hit by a cybersecurity incident, said the healthcare service provider.

In a statement on its website on Nov 9, it said the incident, which involved unauthorised access to the server, appears to have affected migrant workers’ personal data.

This includes their full name, FIN number, date of birth, mobile number, e-mail address and residential address.

The affected data does not contain any health, medical or personal financial information, Fullerton Health said, though it did not share how many migrant workers were impacted.

Fullerton Health said it became aware of the incident on Oct 31 and promptly activated its incident response protocols.

It also implemented precautionary measures across its network to secure its systems while investigations are ongoing.

It said it had notified the Personal Data Protection Commission (PDPC), made a police report and is in contact with the Ministry of Manpower (MOM), which administers the PCP.

“We are cooperating fully with the relevant authorities,” it added

The PCP aims to provide eligible workers in Singapore with accessible and affordable healthcare. It is mandatory for employers here to buy a PCP for certain work permit and S Pass holders, such as those who work in the construction, marine shipyard or process sectors.

Fullerton Health said in its statement that the incident appears to be limited to a specific standalone system supporting its PCP programme, adding that there is no evidence so far that systems supporting other programmes, projects, clients or patients have been affected.

The healthcare service provider said all its managed care services, healthcare services, and facilities remain operational.

It is also taking steps to notify affected migrant workers and provide them with information on the incident as well as where they can seek further assistance.

Noting that some of those affected may need more help in understanding how they have been affected and what precautionary steps they can take to protect themselves, Fullerton Health said it will provide guidance as part of the notification process.

“Protecting personal information is one of Fullerton Health’s highest priorities and we deeply value the trust that our stakeholders have placed in us. We sincerely regret any concern or uncertainty this incident may have caused,” it said, adding that investigations are ongoing.

It added that updates will be provided as more verified information becomes available.

The Straits Times has contacted PDPC, Fullerton Health and MOM for more details.