Agency for Integrated Care reports breach affecting staff data, patient care unchanged
The Agency for Integrated Care disclosed that personal details of about 4,000 healthcare staff may have been accessed in a cyberattack, while the Ministry of Health said patient care and records remain unaffected.
Singapore – The Agency for Integrated Care (AIC) confirmed that an unauthorised third party accessed its Advance Care Planning (ACP) system on Nov 10, potentially exposing names, contact numbers, e-mail addresses and NRIC numbers of up to 4,064 staff members from public hospitals and community care providers. The breach did not affect medical records or other systems, and the ACP platform was restored on Nov 12 after being taken offline for investigation.
"AIC is continuing to investigate the incident, and will carry out a thorough review of its systems and work with the Cyber Security Agency of Singapore to take immediate mitigating actions to strengthen its cyberdefence," the agency said.
The Ministry of Health (MOH) reiterated that the series of recent cyber incidents in the health sector have not disrupted patient care, safety or the integrity of patient health records. MOH urged all licensed healthcare institutions and health-information system providers to heighten vigilance, enhance monitoring and reinforce cybersecurity measures.
"These incidents underscore the importance of being vigilant and, despite the best of efforts, every IT system is vulnerable to the most determined attack," MOH said.
A police report was filed on the day of the breach, and the incident was also reported to the Cyber Security Agency of Singapore. AIC will contact potentially affected individuals within three days and advised them to be cautious of suspicious communications and to avoid sharing personal information.
The breach follows similar unauthorised access incidents at Alliance Medinet, Doctor Anywhere Group, Fullerton Health Group, Minmed Group and Dementia Singapore’s CARA mobile app.