Fullerton Health server supporting migrant worker care programme hit by cybersecurity incident

SINGAPORE: A server supporting Fullerton Health's Migrant Worker Primary Care Plan programme was affected by a cybersecurity incident involving unauthorised access, the healthcare provider said.Preliminary investigations found that the migrant workers' full names, FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses may have been affected, Fullerton Health said in a notice on its website on Monday (Nov 9).The programme is administered by the Ministry of Manpower (MOM). Fullerton Health did not disclose how many migrant workers may have been affected.The company said it became aware of the incident on Oct 31. “Based on our current assessment, the incident appears to be limited to a specific standalone system supporting our Primary Care Plan programme, and there is no evidence at this time that systems supporting other programmes, projects, clients or patients have been affected,” it said.“The affected data does not contain any health/medical or personal financial information,” it added.Fullerton Health said it “promptly activated” its incident response protocols after discovering the incident and implemented precautionary measures across its network to secure its systems while investigations were ongoing.It added that all its managed care services, healthcare services and facilities remained operational.Fullerton Health has notified the Personal Data Protection Commission (PDPC), lodged a police report and contacted MOM.“We are cooperating fully with the relevant authorities,” said Fullerton Health.It is also taking steps to notify affected migrant workers and provide information about the incident and where they can seek further assistance.“We recognise that some individuals may require additional support in understanding how they have been affected and what precautionary steps they can take to protect themselves. Fullerton Health will provide guidance as part of the notification process,” it said.“Investigations remain ongoing, and we will provide further updates as more verified information becomes available.”In response to CNA's queries, PDPC confirmed that it was aware of the incident and was investigating.CNA has also contacted Fullerton Health and MOM for more information.STRING OF CYBER INCIDENTSThe incident follows several recently reported data breaches, including those disclosed by telco M1 and telehealth provider Doctor Anywhere on Nov 6.The M1 data breach exposed customers' personal information, including names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses.Doctor Anywhere also reported a leak of users' personal data, although cybersecurity and forensic specialist Ensign InfoSecurity said clinical records were not affected.Separately, Singapore Airlines said on Nov 3 that data relating to around 46,000 booking records was accessed in a breach involving software provider Amadeus, which affected at least eight airlines.On Tuesday, SPH Media said five of its systems were hit by cyberattacks, while food solutions provider SATS disclosed that Tappee, a school meal ordering application, had been affected by a cyber incident. "(The cyberattacks) are believed to be a concerted effort that was carried out by the same threat actor," SPH Media told CNA. Some personal information, including email addresses, names, mailing addresses and phone numbers, was compromised, but not payment card details, financial or banking information, or customer account access. SATS said the Tappee incident involved "malicious access by an unauthorised external party".Based on investigations so far, the compromised data includes student names, email addresses, financial assistance statuses, student concession card numbers and certain parent and guardian email addresses.A small number of records also contained students' height, weight, allergy profiles and caloric intake data.Four schools in Singapore currently use the app. In response to CNA's query, SATS declined to name the schools "to protect the privacy and interests of affected students and families".