The personal data of about 110,000 Alliance Medinet members has been compromised after an unauthorised party accessed the healthcare services provider’s membership database.
Potentially affected information includes names, personal identification numbers and contact details. Seven members’ bank account information and one member’s medical diagnosis may also have been compromised.
Parent company Alliance Healthcare Group disclosed the findings in a stock exchange filing on 24 October, CNA reported. Affected members were being notified through Alliance Medinet, its partners or relevant clients.
Customers of Three Insurers Affected
HSBC Life, Singlife and Income Insurance have confirmed that customers were affected through their use of Alliance Medinet’s services.
For HSBC Life, the incident affected 2,614 individual policyholders and 1,381 members covered by corporate group policies, according to a notice seen by CNA.
In its public notice dated 24 October, HSBC Life said its own systems were not compromised. Policyholders could continue accessing their benefits, while Alliance Medinet had advised that login credentials and passwords were unaffected.
HSBC Life said investigations were ongoing, but its understanding at that point was that no medical records were at risk. It had informed affected individuals and distribution partners.
Singlife said 323 customers under its Employee Benefits group health insurance might have been affected.
Their potentially exposed information includes names, NRIC numbers, dates of birth, contact numbers, corporate email addresses, company names and policy information, including membership IDs and coverage dates.
In its 24 October statement, Singlife said there was no indication that personal health or medical information was affected, and no evidence that its own systems or network had been compromised.
Income Insurance said the incident affected one corporate account involving about 70 individuals. Potentially affected information includes names, identification numbers, mobile numbers, policy numbers and coverage dates.
It said there was no evidence that these customers’ bank account or medical information had been compromised, and no indication that Income’s own systems were breached.
Investigation Continues as Insurers Warn About Scams
Alliance Healthcare Group said it engaged independent cybersecurity and forensic specialists and introduced round-the-clock network and dark web monitoring. The incident was reported to the Personal Data Protection Commission on 21 October.
Income urged customers to avoid links and attachments in unexpected messages, monitor their bank accounts and contact their bank immediately about suspicious activity.
HSBC Life similarly advised customers to treat unexpected policy-related calls or messages cautiously. Customers should independently verify requests before making payments and avoid sharing passwords, one-time passcodes or banking details in response to unsolicited requests.
