Cyber incidents highlight expanding security risks across Singapore's healthcare sector

A recent wave of cyber incidents has affected a range of Singaporean healthcare entities, including hospitals, clinics, telehealth platforms and third-party service providers, according to local experts. In the last two months, ten breaches were reported, six of which involved healthcare-related organisations.

The Cyber Security Agency of Singapore said the incidents reflect a broader global trend of opportunistic attacks rather than a coordinated campaign, noting that the average monthly number of reported incidents since September has been three times the January-to-August average. It urged organisations to strengthen their cyber defences, adding that threat actors scan the internet for vulnerable systems and can strike even without being specifically targeted.

The Ministry of Health said it is taking the spate of incidents seriously and confirmed that, to its knowledge, none of the breaches involved unauthorised access to patient health records.

"This pattern is not coincidental," said Andrew Kay, senior director of systems engineering at Illumio. "Threat actors prioritise sectors where data is valuable and operational pressure is high, and healthcare meets both criteria."

Associate Professor Razwana Begum of the Singapore University of Social Sciences highlighted the breadth of affected organisations, from providers to telemedicine platforms and third-party administrators, and warned that inter-connected systems can allow a vulnerability in one entity to expose data across several others.

Experts said attackers are increasingly exploiting “side entrances” such as misconfigured cloud servers or weak vendor connections, rather than attempting to breach heavily defended front-door networks. The rapid growth of digital health services, mobile applications and cloud storage has expanded the attack surface, according to a security analyst.

While artificial intelligence could accelerate attack methods, Nanyang Technological University professor Wang Huaxiong said there is no evidence it was used in the recent healthcare breaches.

Security specialists advised healthcare providers to move beyond basic awareness and implement effective controls that can be demonstrated in practice. They emphasized rapid containment of intrusions, thorough assessment of supplier security, limited vendor access, strong authentication, prompt patching of vulnerabilities, network segmentation and continuous monitoring for suspicious activity.

Raffles Medical Group’s chief technology officer, Terence Foo, said the firm regularly reviews and strengthens its cybersecurity practices, conducts system assessments and works closely with technology partners, while maintaining a risk-based approach to protect patient information and ensure service continuity.

Overall, experts stressed that the goal is to make successful intrusions harder, limit their impact and preserve continuity of care, rather than achieving absolute protection.