Singapore insurance customers among 110,000 hit by Alliance Medinet data breach
Alliance Medinet provides services to several insurers, including HSBC Life, Singlife and Income Insurance, which have reported that their customers were affected by the incident.
A view of Alliance Medinet's logo displayed on a TV screen in this illustration. (Image: Alliance Medinet)
This audio is generated by an AI tool.
SINGAPORE: The personal data of about 110,000 members of healthcare services provider Alliance Medinet has been compromised in a cyber incident, with customers of insurers HSBC Life, Income Insurance and Singlife among those affected.
The three insurers said nearly 4,400 of their customers were affected or potentially affected by the incident, which involved unauthorised access to Alliance Medinet's membership database.
The potentially compromised information includes names, personal identification numbers and contact details, parent company Alliance Healthcare Group said in a bourse filing on Saturday (Oct 24).
Bank account information belonging to seven members and one member's medical diagnosis might also have been compromised, it added.
Alliance Medinet is the corporate healthcare arm of Alliance Healthcare Group, specialising in managed healthcare services and third-party administration services.
The group said affected members were in the process of being notified by Alliance Medinet, its partners or relevant clients.
In response to CNA's queries, the Cyber Security Agency of Singapore said it was aware of the incident and was monitoring developments closely.
INSURERS AFFECTED
HSBC Life said 2,614 individual policyholders and 1,381 members under group corporate policies were affected.
In a notice seen by CNA, the insurer said the potentially compromised information included names, personal identification numbers and contact details.
Investigations were ongoing, but HSBC Life said it understood that no medical records were at risk.
It stressed that its own systems were not compromised and that policyholders could continue accessing their benefits as usual. Alliance Medinet had also advised that login credentials and passwords were unaffected.
HSBC Life said it had informed affected individuals and distribution partners, and advised policyholders to remain vigilant against scams and phishing attempts.
Income Insurance said the incident affected one of its corporate accounts, involving about 70 individuals.
The potentially affected information included names, personal identification numbers, mobile numbers, policy numbers and coverage start and end dates.
"There is currently no evidence that bank account information or medical information has been compromised," it said on Saturday, adding that it had taken steps to inform those affected.
Meanwhile, Singlife said 323 customers under its Employee Benefits group health insurance could have been affected.
The potentially compromised data included names, NRIC numbers, dates of birth, contact numbers, corporate email addresses, company names and policy information.
"There is currently no indication that any personal health or medical information is affected," Singlife said, adding that it had contacted affected customers.
All three insurers said there was no evidence that their own systems had been compromised.
According to an advisory by Great Eastern, the bank account information of three members may have been compromised as a result of the incident.
It added that, based on the latest information from ongoing investigations, it was updated that the types of personal data potentially affected include names, personal identification numbers and contact information.
However, Great Eastern said its IT systems have not been compromised and that its systems continue to operate securely, adding that individual life, health, personal accident and general insurance policies were not affected.
It has reached out to all affected members of its corporate employee benefit schemes and is "working closely with Alliance Medinet and relevant authorities on this matter".
INVESTIGATIONS ONGOING
Alliance Healthcare Group said it acted immediately to contain the incident upon discovering it and engaged independent cybersecurity and forensic specialists to investigate the breach.
It has also introduced round-the-clock network monitoring and dark web monitoring systems, while strengthening its IT systems, processes and security controls.
The incident was reported to Singapore's Personal Data Protection Commission on Oct 21.
"Protecting the information entrusted to us is a responsibility we take very seriously, and we remain committed to working closely with all parties to resolve the matter," the group said.
It added that its other subsidiaries were not affected by the incident.
Alliance Healthcare Group said it would provide a fuller update in due course and keep shareholders informed of any material developments.
It also advised shareholders to exercise caution when dealing in its shares or securities and to seek professional advice where necessary.
The Personal Data Protection Commission said on Saturday in response to CNA's query that it is aware and investigating.
