MOH concerned as AIC becomes latest healthcare body hit by cyberattack; data of over 4,000 healthcare workers exposed

Following a series of breaches of healthcare institutions’ computer systems in Singapore, the Agency for Integrated Care confirmed on Thursday (12 November) that its system had also been accessed without authorisation. The personal data of more than 4,000 healthcare workers may have been exposed.

The Ministry of Health (MOH) said it was deeply concerned about the repeated cybersecurity incidents involving healthcare systems, stressing that patient care operations had not been affected. It reminded all healthcare institutions and healthcare-related system providers to remain vigilant and strengthen their cybersecurity defences to ensure the security and integrity of their IT assets, systems and patient data.

In a statement issued on Thursday, the Agency for Integrated Care (AIC) said it had detected a cybersecurity incident involving its Advance Care Planning IT system on Tuesday (10 November).

The personal data of as many as 4,064 healthcare workers from public healthcare institutions and community care providers may have been exposed, including their names, contact numbers, email addresses and identity card numbers. Investigations are ongoing, and there is currently no indication that medical records or patient data have been exposed, or that other systems have been affected.

AIC lodged a police report that day and also notified the Cyber Security Agency of Singapore (CSA). AIC will conduct a comprehensive review of its systems and work with CSA to take immediate steps to strengthen its cyber defences.

The affected Advance Care Planning IT system helps members of the public record their wishes and expectations for their future medical care. As a precaution, the system was taken offline on the day of the incident and restored on Thursday.

AIC will contact potentially affected healthcare workers over the next three days. It also advised those affected to be alert to suspicious and unsolicited emails, text messages and phone calls, and to avoid sharing personal information, passwords or one-time passwords with anyone unless they are certain of the person’s identity. Anyone who suspects they have been affected can contact AIC on 1800-650-6060 or at enquiries@aic.sg.

Since late October, several healthcare organisations have suffered cyberattacks on their systems, including Alliance Medinet, telemedicine platform Doctor Anywhere, Fullerton Health, Minmed, Dementia Singapore and AIC.

In a statement issued on Thursday, MOH stressed: These breaches have not disrupted patient care operations.

“There is no evidence thus far to suggest that patient safety and care had been compromised. To our knowledge, there had not been unauthorised access of patient health records in these breaches. Nevertheless, MOH is following up with the affected entities to check on the full implications from these incidents.”

MOH has asked national health technology agency Synapxe and public healthcare institutions to remain vigilant and step up monitoring for potential cyber threats to public healthcare IT systems. The ministry said private healthcare institutions should also review and strengthen their cybersecurity measures to protect their systems and patient data from cyber threats.

MOH stressed: “These incidents underscore the importance of being vigilant and despite the best of efforts, every IT system is vulnerable to the most determined attack. With the advancement of technology, especially AI, vulnerabilities will be easily exposed and cyberattacks more frequent, rapid and formidable.”

The ministry reminded all licensed healthcare institutions and medical information management system providers to remain vigilant and strengthen their cybersecurity defences to ensure the security and integrity of their IT assets, systems and patient data.