Fullerton Health Cyber Incident May Have Exposed Migrant Worker Records

SINGAPORE – A server supporting Fullerton Health’s Migrant Worker Primary Care Plan programme was hit by a cybersecurity incident involving unauthorised access, the healthcare provider said, and personal details of migrant workers may have been affected.

What may have been exposed

Preliminary investigations found that migrant workers’ full names, foreign identification (FIN) numbers, dates of birth, mobile numbers, email addresses and residential addresses may have been affected, Fullerton Health said in the notice, Channel NewsAsia reported.

The programme is administered by the Ministry of Manpower. Fullerton Health did not say how many migrant workers may have been affected.

“Based on our current assessment, the incident appears to be limited to a specific standalone system supporting our Primary Care Plan programme, and there is no evidence at this time that systems supporting other programmes, projects, clients or patients have been affected,” the company said. “The affected data does not contain any health/medical or personal financial information.”

Response

The company said it promptly activated its incident response protocols after discovering the incident and put precautionary measures in place across its network. All of its managed care services, healthcare services and facilities remained operational, it said.

Fullerton Health has notified the Personal Data Protection Commission, lodged a police report and contacted the Ministry of Manpower. It said it is cooperating with the authorities and is taking steps to notify affected migrant workers and tell them where they can get help.

In response to CNA’s queries, the PDPC confirmed that it was aware of the incident and was investigating. CNA also contacted Fullerton Health and the ministry for more information.

Wider string of incidents

The Fullerton Health case follows several recently reported breaches in Singapore, including those disclosed by telco M1 and telehealth provider Doctor Anywhere on 6 November, and a 3 November disclosure by Singapore Airlines that data relating to about 46,000 booking records was accessed in a breach involving software provider Amadeus, which affected at least eight airlines.

On Tuesday, SPH Media said five of its systems were hit by cyberattacks that it believes were a concerted effort by the same threat actor, and food solutions provider SATS said its Tappee school meal ordering application had been accessed by an unauthorised external party. Fullerton Health did not say whether its incident was linked to those cases.

Sources

• CNA: Fullerton Health server supporting migrant worker care programme hit by cybersecurity incident