Singapore insurance customers among 110,000 hit by Alliance Medinet data breach
Alliance Medinet provides services to several insurers, including HSBC Life, Singlife and Income Insurance, which have reported that their customers were affected by the incident.
by Rachel Lim · CNA · JoinRead a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST Tap here to return to FAST
FAST
SINGAPORE: The personal data of about 110,000 members of healthcare services provider Alliance Medinet has been compromised in a cyber incident, with customers of insurers HSBC Life, Income Insurance and Singlife among those affected.
The three insurers said nearly 4,400 of their customers were affected or potentially affected by the incident, which involved unauthorised access to Alliance Medinet's membership database.
The potentially compromised information includes names, personal identification numbers and contact details, parent company Alliance Healthcare Group said in a bourse filing on Saturday (Oct 24).
Bank account information belonging to seven members and one member's medical diagnosis might also have been compromised, it added.
CNA Games
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
Show More
Show Less
Alliance Medinet is the corporate healthcare arm of Alliance Healthcare Group, specialising in managed healthcare services and third-party administration services.
The group said affected members were in the process of being notified by Alliance Medinet, its partners or relevant clients.
In response to CNA's queries, the Cyber Security Agency of Singapore said it was aware of the incident and was monitoring developments closely.
INSURERS AFFECTED
HSBC Life said 2,614 individual policyholders and 1,381 members under group corporate policies were affected.
In a notice seen by CNA, the insurer said the potentially compromised information included names, personal identification numbers and contact details.
Investigations were ongoing, but HSBC Life said it understood that no medical records were at risk.
It stressed that its own systems were not compromised and that policyholders could continue accessing their benefits as usual. Alliance Medinet had also advised that login credentials and passwords were unaffected.
HSBC Life said it had informed affected individuals and distribution partners, and advised policyholders to remain vigilant against scams and phishing attempts.
Income Insurance said the incident affected one of its corporate accounts, involving about 70 individuals.
The potentially affected information included names, personal identification numbers, mobile numbers, policy numbers and coverage start and end dates.
"There is currently no evidence that bank account information or medical information has been compromised," it said on Saturday, adding that it had taken steps to inform those affected.
Meanwhile, Singlife said 323 customers under its Employee Benefits group health insurance could have been affected.
The potentially compromised data included names, NRIC numbers, dates of birth, contact numbers, corporate email addresses, company names and policy information.
"There is currently no indication that any personal health or medical information is affected," Singlife said, adding that it had contacted affected customers.
All three insurers said there was no evidence that their own systems had been compromised.
CNA has contacted Great Eastern, which also uses Alliance Medinet's services, to ask whether its customers were affected.
INVESTIGATIONS ONGOING
Alliance Healthcare Group said it acted immediately to contain the incident upon discovering it and engaged independent cybersecurity and forensic specialists to investigate the breach.
It has also introduced round-the-clock network monitoring and dark web monitoring systems, while strengthening its IT systems, processes and security controls.
The incident was reported to Singapore's Personal Data Protection Commission on Oct 21.
"Protecting the information entrusted to us is a responsibility we take very seriously, and we remain committed to working closely with all parties to resolve the matter," the group said.
It added that its other subsidiaries were not affected by the incident.
Alliance Healthcare Group said it would provide a fuller update in due course and keep shareholders informed of any material developments.
It also advised shareholders to exercise caution when dealing in its shares or securities and to seek professional advice where necessary.
The Personal Data Protection Commission said on Saturday in response to CNA's query that it is aware and investigating.
Sign up for our newsletters
Get our pick of top stories and thought-provoking articles in your inbox
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app