Personal data of 110,000 members compromised in Alliance Medinet cyber incident
Alliance Medinet provides services to several insurers, including HSBC Life, Singlife and Income Insurance, which have reported being affected by the incident.
by Rachel Lim · CNA · JoinRead a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST Tap here to return to FAST
FAST
SINGAPORE: The personal data of about 110,000 members of healthcare services provider Alliance Medinet has been compromised in a cybersecurity incident involving unauthorised access to its membership database.
The potentially affected data includes names, personal identification numbers and contact information, parent company Alliance Healthcare Group said in a bourse filing on Saturday (Oct 24).
It added that bank account information belonging to seven members and one member's medical diagnosis might also have been compromised.
"Based on investigations conducted to date, the personal data of approximately 110,000 members in that membership database have been compromised by a third-party," it said.
CNA Games
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
Show More
Show Less
Alliance Medinet is the corporate healthcare arm of Alliance Healthcare Group, specialising in managed healthcare services and third-party administration services, among others.
The group said affected members were in the process of being notified by Alliance Medinet, its partners or relevant clients.
Other subsidiaries of Alliance Healthcare Group were not affected by the incident, it added.
In response to CNA's queries, the Cyber Security Agency of Singapore said it was aware of the incident and monitoring developments closely.
INSURERS AFFECTED
Several insurers using Alliance Medinet's services said that they had been affected by the incident.
In a notice seen by CNA, HSBC Life said 2,614 individual policyholders and 1,381 members under group corporate policies were affected.
The potentially affected data included their names, NRIC numbers, dates of birth, email addresses, mobile numbers and information on their policies, including the policy's name and benefits, it said.
Customers could still access the Benefits Hub app, as Alliance Medinet had indicated that login credentials were unaffected, it added.
Income Insurance said in a press release on Saturday that the incident affected one of its corporate accounts, involving about 70 individuals.
The insurer said names, personal identification numbers, mobile numbers, policy numbers and coverage start and end dates were among the potentially affected data.
“There is currently no evidence that bank account information or medical information has been compromised,” it said, adding that steps have been taken to inform those affected.
Meanwhile, insurance provider Singlife said 323 customers under its Employee Benefits group health insurance could have been affected.
The potentially affected data included names, NRIC numbers, dates of birth, contact numbers, corporate email addresses, company names and policy information.
"There is currently no indication that any personal health or medical information is affected," Singlife said. Affected Singlife customers have already been contacted.
All three insurers said there was no evidence that their own systems were compromised.
CNA has reached out to Great Eastern, which also uses Alliance Medinet’s services, to ask if their customers were affected.
ONGOING INVESTIGATION
Alliance Healthcare Group said its team acted immediately to contain the incident after discovering it.
It engaged independent cybersecurity and forensic specialists to support a formal investigation and further strengthen its IT systems, processes and security controls.
"Investigations are currently ongoing," it said, adding that 24-hour network monitoring and dark web monitoring systems had been put in place.
The incident was reported to Singapore's Personal Data Protection Commission on Oct 21.
"Protecting the information entrusted to us is a responsibility we take very seriously, and we remain committed to working closely with all parties to resolve the matter," it said.
The group said it would provide a fuller update in due course, and would keep shareholders updated of any material development.
It also advised shareholders to exercise caution when dealing in its shares or securities and to seek professional advice where necessary.
Sign up for our newsletters
Get our pick of top stories and thought-provoking articles in your inbox
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app