Hackers stole 1.5 million personal records from Singapore’s largest healthcare organization in what local media is calling the country’s worst cyberattack ever.
The heist included the personal health information, including medical prescriptions, of Singapore Prime Minister Lee Hsien Loong (pictured above) and other unnamed ministers, the Straits Times reported. Lee subsequently said in a Facebook post that he didn’t know why the attackers would specifically go after his personal medical information, Reuters reported.
An initial investigation by authorities indicated that the cyber burglars infected a front-end workstation at SingHealth to gain privileged account credentials to its database of records. The hackers reportedly carried out the attack between June 27 and July 4, 2018, going after patients’ personal identifiable information, such as their National Registry Identity Card, names, addresses, gender, race and date of birth, but leaving medical data on all but 160,000 people intact, according to the Straits Times. Patients who visited any of SingHealth’s facilities dating back to May, 2015 were potentially impacted.
“Investigations by the Cyber Security Agency of Singapore (CSA) and the Integrated Health Information System (IHiS) confirmed that this was a deliberate, targeted and well-planned cyberattack,” a government statement said. Officials said the heist was “not the work of casual hackers or criminal gangs.”
It’s not known at this point who carried out the attack but early speculation is suggesting it was state sponsored. David Koh, CEO of Singapore’s Cyber Security Agency described the heist as “deliberate, targeted and well-planned” and Lee termed the hackers “extremely skilled and determined” with “huge resources” behind them.
Gam Kim Yong, Singapore’s Health Minister, apologized to affected patients, the Straits Times said.
Officials said that the IHiS and the CSA have temporarily blocked internet surfing on all of SingHealth's 28,000 computers, tightened controls on workstations and servers, reset user and server accounts and set up system monitoring. All IT systems in the country’s healthcare system will be equipped with similar procedures and protections, officials said. Koh has been directed to launch an independent external review of the incident.
SingHealth said it is in the process of notifying patients who visited its clinics during the affected three-year period if their data has been swept up in the hack.
The National Electronic Health Record (NEHR) project, Singapore's electronic health records sharing system, has been put on hold for the time being but not shelved, Minister for Communications and Information S. Iswaran said. “We must not let this derail our Smart Nation services... it is the way of the future,” he said, the Strait Times reported.
