SINGAPORE: The personal data of about 110,000 members of healthcare services provider Alliance Medinet has been compromised in a cybersecurity incident involving unauthorised access to its membership database.
The potentially affected data includes names, personal identification numbers and contact information, parent company Alliance Healthcare Group said in a bourse filing on Saturday (Oct 24).
It added that bank account information belonging to seven members and one member's medical diagnosis might also have been compromised.
"Based on investigations conducted to date, the personal data of approximately 110,000 members in that membership database have been compromised by a third-party," it said.
Alliance Medinet is the corporate healthcare arm of Alliance Healthcare Group, specialising in managed healthcare services and third-party administration services, among others.
The group said affected members were in the process of being notified by Alliance Medinet, its partners or relevant clients.
Other subsidiaries of Alliance Healthcare Group were not affected by the incident, it added.
In response to CNA's queries, the Cyber Security Agency of Singapore said it was aware of the incident and monitoring developments closely.
INSURERS AFFECTED
Alliance Medinet provides services to several insurers, including HSBC Life, Great Eastern and Income Insurance.
In a notice seen by CNA, HSBC Life said 2,614 individual policyholders and 1,381 members under group corporate policies were affected.
It added that its systems were not compromised and customers could still access the Benefits Hub app, as Alliance Medinet had indicated that login credentials were unaffected.
Income Insurance said in a press release on Saturday that the incident affected one of its corporate accounts, involving about 70 individuals.
The insurer said the personal data potentially affected included names, personal identification numbers, mobile numbers, policy numbers and coverage start and end dates.
“There is currently no evidence that bank account information or medical information has been compromised,” it added.
Income Insurance said it had activated its incident response processes and informed the relevant authorities after being notified of the incident on Thursday.
“We have also taken the necessary steps to inform the affected policyholder and individuals,” it said.
Income Insurance is working with Alliance Medinet to investigate the matter, verify the information involved and assess the potential impact, it added.
“There is currently no indication that Income Insurance’s systems were compromised.”
Income Insurance also advised customers to remain vigilant against potential scams, including suspicious messages seeking their personal information.
CNA has reached out to other insurers using Alliance Medinet’s services, including Great Eastern and Singlife to ask if their customers were affected.
ONGOING INVESTIGATION
Alliance Healthcare Group said its team acted immediately to contain the incident after discovering it.
It engaged independent cybersecurity and forensic specialists to support a formal investigation and further strengthen its IT systems, processes and security controls.
"Investigations are currently ongoing," it said, adding that 24-hour network monitoring and dark web monitoring systems had been put in place.
The incident was reported to Singapore's Personal Data Protection Commission on Oct 21.
"Protecting the information entrusted to us is a responsibility we take very seriously, and we remain committed to working closely with all parties to resolve the matter," it said.
The group said it would provide a fuller update in due course, and would keep shareholders updated of any material development.
It also advised shareholders to exercise caution when dealing in its shares or securities and to seek professional advice where necessary.