The personal data of about 110,000 members of Alliance Medinet has been compromised in a cyber incident, parent company Alliance Healthcare Group told the Singapore Exchange in a filing on 24 October. Customers of HSBC Life, Singlife and Income Insurance are among those affected.
What was exposed
A third party gained unauthorised access to the system holding Medinet’s membership database. The data involved includes names, personal identification numbers and contact information. Seven members might have had their bank account information compromised, and one member’s medical diagnosis might have been breached.
Medinet, its partners and relevant clients are notifying affected members. The rest of the Alliance Healthcare group is not affected.
How the company responded
The company contained the incident on discovery and brought in independent cybersecurity and forensic specialists to investigate. It has added 24-hour network monitoring and dark web monitoring, and reported the incident to the Personal Data Protection Commission on 21 October. A fuller update will follow.
Insurers affected
Singlife puts its count at 323 customers under its Employee Benefits group health insurance. Their names, NRIC numbers, dates of birth, contact numbers, corporate email addresses, company names and policy details may have been affected. Singlife has no indication that health or medical information is involved, and was told of the impact on 22 October.
Income Insurance has one corporate account affected, involving about 70 individuals. Names, identification numbers, mobile numbers, policy numbers and coverage dates were involved, with no evidence that bank or medical information was compromised.
HSBC Life Singapore has informed impacted individuals and its distribution partners. Names, identification numbers and contact details may be affected, and no medical records are understood to be at risk. CNA and The Straits Times reported that HSBC Life put the number affected at 2,614 individual policyholders and 1,381 members under group corporate policies. Policyholders can keep using their benefits as usual, and Medinet has advised that login credentials and passwords were not affected.
All three insurers stress that their own systems were not compromised.
Watch for scams
Members should be wary of unexpected calls, emails or messages about their policy, and should not share passwords, one-time passcodes or banking details in reply. Medinet can be reached on 6664 0860, 24 hours a day, or at [email protected].
