Fullerton Health breach exposes data of 140,000 migrant workers
A cyber incident on a Fullerton Health server compromised personal details of about 140,000 migrant worker work pass holders, though health and financial information remained secure.
About 140,000 work pass holder records were accessed without authorization in a cyber incident involving a Fullerton Health portal, according to statements from Fullerton Health Group (FHG) and the Ministry of Manpower (MOM) on Nov 14. The breach affected a standalone server that supported the Migrant Worker Primary Care Plan (PCP) programme and exposed full names, foreign identification numbers, dates of birth, mobile numbers, e-mail addresses and residential addresses. No health, medical or personal financial data were reported as compromised.
FHG, one of four anchor operators appointed by MOM to run the PCP, said it became aware of the incident on Oct 31, notified MOM on Nov 2 and alerted the public on Nov 9. The provider isolated the affected server and is building a new server with security measures embedded from the start to host a new PCP enrolment portal. > "This approach ensures that the compromised server will not be used," FHG said. > "We will continue to monitor the threat landscape for continuous improvement to our security posture," it added.
Both FHG and MOM emphasized that the breach has not disrupted migrant workers’ access to the PCP, which remains available for eligible workers in sectors such as construction, marine shipyard and process industries. Employers were used to notify affected workers in two rounds, and MOM also sent direct notifications via its FWMOMCare mobile app in workers’ native languages, warning them to be cautious of unsolicited communications requesting personal information.
Preliminary checks by FHG’s security monitoring provider, Logicalis, found no signs of abnormal activity on other IT assets. MOM said it is working closely with FHG on investigations and has reminded all PCP anchor operators to maintain adequate data security. The Ministry of Health (MOH) has similarly instructed national health-tech agency Synapxe and public healthcare institutions to strengthen monitoring of their IT systems.
The Fullerton Health incident occurs amid a series of recent cyber events affecting Singapore’s healthcare sector, including breaches at the Agency for Integrated Care, Alliance Medinet, Doctor Anywhere Group, Minmed Group and Dementia Singapore’s CARA app. MOH noted that patient care operations have not been disrupted and no evidence suggests patient health records were compromised. The Cyber Security Agency of Singapore reported at least 12 cyber incidents involving local organisations between Oct 24 and Nov 13, half of which involved healthcare and community-care entities. PDPC said the breaches stem from common IT vulnerabilities and are not linked to a single coordinated attack.