Fullerton Health Discloses Cyber Incident Exposing Migrant Workers' Personal Data

On Monday, Nov 9, Fullerton Health posted a notice on its website saying that a server supporting its Migrant Worker Primary Care Plan programme had been hit by a cybersecurity incident involving unauthorised access. The programme is administered by Singapore's Ministry of Manpower (MOM).

Preliminary investigations indicate that migrant workers' full names, FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses may have been affected. Fullerton Health did not say how many workers that could cover. The company said it became aware of the incident on Oct 31, nine days before the public notice.

The company drew a boundary around the problem. Based on its current assessment, it said, the incident appears limited to a specific standalone system supporting the Primary Care Plan, and there is no evidence at this time that systems supporting other programmes, projects, clients or patients were touched. It also said the affected data contains no health or medical information and no personal financial information. All its managed care services, healthcare services and facilities, it added, remained operational.

Fullerton Health said it promptly activated its incident response protocols once it found the problem, and put precautionary measures in place across its network to secure its systems while investigations continued. It has notified the Personal Data Protection Commission (PDPC), lodged a police report and contacted MOM, and says it is cooperating fully with the authorities. In response to queries from CNA, the PDPC confirmed it was aware of the incident and was investigating. CNA has also approached Fullerton Health and MOM for more information.

For the workers themselves, the company said it is taking steps to notify those affected and to tell them where they can seek further help. It acknowledged that some people may need additional support in understanding how they have been affected and what precautions they can take, and said guidance would come as part of the notification process. Investigations remain ongoing, it said, and further updates will follow as more verified information becomes available.

The disclosure lands in a crowded week for data incidents in Singapore. On Nov 6, telco M1 and telehealth provider Doctor Anywhere both reported breaches. M1's exposed customers' names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses. Doctor Anywhere reported a leak of users' personal data, though cybersecurity and forensic specialist Ensign InfoSecurity said clinical records were not affected.

On Nov 3, Singapore Airlines said data relating to around 46,000 booking records had been accessed in a breach involving software provider Amadeus, which affected at least eight airlines. On Tuesday, SPH Media said five of its systems were hit by cyberattacks, which it told CNA are believed to be a concerted effort by the same threat actor. Email addresses, names, mailing addresses and phone numbers were compromised, but not payment card details, financial or banking information, or customer account access.

Also on Tuesday, food solutions provider SATS disclosed that Tappee, a school meal ordering app, had suffered malicious access by an unauthorised external party. The compromised data includes student names, email addresses, financial assistance statuses, student concession card numbers and some parent and guardian email addresses. A small number of records also held students' height, weight, allergy profiles and caloric intake data. Four Singapore schools use the app; SATS declined to name them, citing the privacy and interests of affected students and families.

What to watch next: the PDPC's investigation, whether Fullerton Health discloses how many workers are affected, and the updates the company has promised.