Alliance Medinet data breach affects 110,000 members

SINGAPORE – The personal data of about 110,000 members of healthcare services provider Alliance Medinet has been compromised in a cyber incident involving unauthorised access to its database.

Personal data such as names, personal identification numbers and contact information is potentially affected, said its parent company Alliance Healthcare Group in a bourse filing on Oct 24.

It added that the bank account information of seven members in the database and one member’s medical diagnosis might have been compromised.

The data breach involved a third party’s unauthorised access to Alliance Medinet’s system containing its membership database, the parent company said.

Investigations are ongoing, Alliance Healthcare Group said. It added that the affected members are being notified by Alliance Medinet and/or its partners and relevant clients.

Alliance Medinet – the corporate healthcare arm of Alliance Healthcare Group – specialises in managed healthcare services, offering personalised corporate healthcare solutions and third-party administration services, according to the subsidiary’s website.

The subsidiary was established in 2005 and has a network of more than 2,000 panel clinics across Singapore, it said on its website.

Income Insurance and Singlife, which Alliance Medinet provides services to, are among those affected by the data breach.

One Income Insurance corporate account, involving about 70 individuals, was affected, and 323 customers under Singlife’s Employee Benefits group health insurance may have been affected, both insurers said in separate statements on Oct 24.

The types of personal data potentially affected include names, personal identification numbers, contact information such as mobile numbers, policy numbers and coverage start and end dates, both insurers said.

Singlife, in its statement, also said that data such as dates of birth, corporate e-mail addresses and company names might have been affected.

Both insurers said there is currently no indication that any medical information was affected.

Income Insurance also said there is no evidence that bank account information of its customers has been compromised.

Both insurers said there is currently no evidence that their systems have been compromised.

In their statements, Income Insurance and Singlife said that upon being notified by Alliance Medinet on Oct 22 of the breach, they informed the relevant authorities immediately. Those affected were also informed.

Both insurers added that they will continue to work with Alliance Medinet and the authorities, and provide further updates as more information becomes available.

In the Oct 24 bourse filing, Alliance Healthcare Group said: “Upon discovery, the team acted immediately to contain the incident and engaged independent cybersecurity and forensic specialists to support a formal investigation and further strengthen our IT systems, processes and security controls.

“We have also put in place 24-hour network monitoring and dark web monitoring systems.”

The incident was reported to the Personal Data Protection Commission of Singapore on Oct 21, Alliance Healthcare Group said.

A fuller update will be provided in due course, Alliance Healthcare Group said, adding that the rest of the group is not affected by the incident.

“Protecting the information entrusted to us is a responsibility we take very seriously, and we remain committed to working closely with all parties to resolve the matter,” Alliance Healthcare Group said.

“The company and Medinet regret the inconvenience this incident has caused.”

The Straits Times has contacted the Cyber Security Agency of Singapore and the Personal Data Protection Commission for more information.