1.5 Million Personal Data, Including PM Lee’s, Stolen In Major Cyberattack

An old man once told me, money isn’t the most powerful thing in existence. It’s information.

And plenty of people agreed with him, including Sun Tzu, who advocates that to win every war, know your enemy and know thyself.

Or something along that line.

And in today’s world, that saying is true, more than ever.

What is SingHealth

In case you don’t know what SingHealth is, it’s the largest healthcare group in Singapore.

And their portfolio includes:

• Polyclinics
• SingHealth Community Hospitals
• National Cancer Centre
• Singapore National Eye Centre
• National Dental Centre
• National Neuroscience Institute
• KK Women’s and Children’s Hospital
• Changi General Hospital
• Singapore General Hospital
• Sengkang General Hospital

So when you hear that they’ve suffered a data leak? That’s a cause for alarm.

1.5 million people personal information stolen from SingHealth

On 20 July, it was reported that SingHealth has had 1.5 million patients’ personal information stolen.

And 160,000 of them had outpatient prescriptions stolen as well.

The affected patients had visited SingHealth’s specialist outpatient clinics and polyclinics from 1 May 2015 to 4 Jul 2018.

And includes the data of our very own prime minister Lee Hsien Loong and a few other ministers.

According to the report, it seems like his data was repeatedly and specifically targeted.

Hackers had managed to gain access to the computers of SingHealth and gained non-medical personal data like their names, IC numbers, addresses, gender, race and dates of birth.

Thankfully, other patient records like diagnosis, test results and doctors’ notes were not breached.

Health Minister Gan Kim Yong apologised for the incident.

A Rough Timeline of What Happened

On 4 July, unusual activity was detected on one of SingHealth’s IT databases.

Security measures like blocking of dubious connections and changing of passwords were made immediately.

On 10 July, forensic investigations revealed that it was a cyber attack.

A police report was lodged on 12 July, and it was found that there was no further data stolen since 4 July.

So What Happens Now?

SingHealth said they’ll be contacting patients who visited their specialist outpatient clinics and polyclinics in the period between 1 May 2015 to 4 Jul 2018.

They will inform them if their data has been stolen.

Singapore Smart Nation to be pushed back

Singapore has been touting the Smart Nation tagline for quite some time. I mean, even our government is going to be led by the 4G team. Get it?

But this attack put all that on the backburner.

The government has seen fit to press the pause button on all of Singapore’s Smart Nation plans.

However, it was emphasised that the plans are only going to be paused, and not cancelled like the SG-KL HSR might be.

An independent Committee of Inquiry will be set up to investigate the incident.

Fake SMSes Sent Out Immediately After SingHealth’s Announcement

SingHealth can never catch a break, huh?

Immediately after they announced that they’ll be contacting the affected patients, people started receiving fake SMSes.

The SMS told recipients that their non-medical personal data, telephone numbers, financial details and medical records have been accessed.

SingHealth says that this message wasn’t sent by them, and uploaded an image of the official message for reference.

If you can’t wait for them to get to you, you can check if your data is safe using this link.