Dementia Singapore app users' personal data potentially compromised in cyber incident

SINGAPORE: The personal data of some members of Dementia Singapore's CARA mobile application may have been compromised in a cybersecurity incident earlier this month, said the social service agency. 

The incident occurred on Nov 1 and involved unauthorised notifications being sent to some members, it said in an email seen by CNA.

Preliminary investigations found that names, email addresses, phone numbers and membership IDs may have been affected. But no NRIC numbers were affected, Dementia Singapore said.

The agency did not disclose how many members may have been affected.

CARA is a membership programme by Dementia Singapore that supports people living with dementia and their caregivers through a mobile app.

It replaces the National Council of Social Service's Safe Return Card initiative, which helps members of the public identify and assist people living with dementia who may become lost.

The app provides a unique QR code identifier for members living with dementia and allows multiple caregivers to link their accounts to a loved one and receive notifications. Members can also access rewards and benefits from participating partners.

INVESTIGATIONS ONGOING

Following the incident, the app's third-party service provider took immediate steps to contain the situation and secure its systems, Dementia Singapore said.

The agency is working with the service provider to investigate the incident and establish its full extent.

It has also reported the incident to the Personal Data Protection Commission (PDPC).

Members can continue using the CARA SG app but should update it to the latest version through the Apple App Store or Google Play Store, Dementia Singapore said.

It urged members to remain vigilant against unexpected emails, calls or messages purporting to be from Dementia Singapore or CARA, and to avoid clicking on suspicious links or downloading unexpected attachments.

Members should also not share their passwords or one-time passwords with anyone, it added.

"We apologise for any worry or inconvenience caused and appreciate the trust you place in Dementia Singapore and CARA," said Dementia Singapore CEO Bryan Tan.

CNA has contacted Dementia Singapore, PDPC and the police for more information.

STRING OF CYBER INCIDENTS

The incident comes amid a string of recently reported cybersecurity incidents involving organisations in Singapore.

On Wednesday (Nov 11), healthcare provider Minmed Group said a system supporting its teleconsultation and health screening services had been affected by a "malicious cybersecurity incident".

The group said the incident appeared to be limited to a standalone system and that clinical records were not affected.

Minmed said it took immediate steps to contain the incident and engaged cybersecurity firm Ensign InfoSecurity to support investigations and strengthen its systems. 

It has also reported the incident to the PDPC and lodged a police report, while its healthcare services and clinics remain operational.

On Monday, healthcare provider Fullerton Health said a server supporting its Migrant Worker Primary Care Plan programme had been affected by unauthorised access.

Personal information, including migrant workers' names, foreign identification numbers, dates of birth and contact details, may have been affected. Fullerton Health said there was no evidence that systems supporting its other programmes, projects, clients or patients were affected.

Separately, telehealth provider Doctor Anywhere said on Nov 6 that users' personal data had been leaked in a "malicious cyber incident" involving unauthorised access by an unknown third party.

It did not disclose how many users were affected or what type of data had been compromised, but said investigations had found that clinical records were unaffected.