About 140,000 migrant workers in Singapore had their personal records compromised in a cyberattack on healthcare provider Fullerton Health, the company confirmed on Saturday, nearly two weeks after it first disclosed the incident without saying how many people were affected.
The breach hit a standalone server supporting the Migrant Worker Primary Care Plan, a government-administered programme that gives eligible migrant workers access to affordable primary healthcare. Fullerton Health is one of four anchor operators appointed by Singapore's Ministry of Manpower to run the plan.
What was exposed — and what was not
According to preliminary investigations, the records that may have been exposed include workers' full names, foreign identification numbers, dates of birth, mobile phone numbers, email addresses and residential addresses. About 43,000 of the 140,000 records belonged to people whose work passes were no longer valid.
Fullerton Health stressed that no health, medical or personal financial information was compromised. The company said it promptly isolated the affected server after discovering the incident and put precautionary measures in place across its network.
As part of its remediation, Fullerton Health is building an entirely new server, with security measures built in from the start, to host a new enrolment portal for the care plan. The old server will not be reused.
A two-week wait for the scale of the breach
Fullerton Health said it became aware of the unauthorised access on October 31. It notified the Ministry of Manpower on November 2 and alerted the public in a website notice on November 9, but that notice gave no figure for how many workers were affected. The 140,000 number only emerged on Saturday, November 14, in the company's responses to questions from Channel NewsAsia and The Straits Times.
The Ministry of Manpower has notified affected workers directly through its FWMOMCare mobile app, and Fullerton Health said it has completed two rounds of notifications through employers. Both the company and the ministry stressed that the incident has not disrupted workers' access to the care plan, and they can continue to seek medical care as usual.
The company's security monitoring provider, Logicalis, found no evidence of abnormalities or breaches across the other Fullerton Health IT assets it monitors, based on its preliminary probe.
Part of a wider breach streak
Singapore's Personal Data Protection Commission said preliminary information indicated the recent incidents were opportunistic attacks exploiting common IT system vulnerabilities, with no apparent link between them. The Cyber Security Agency of Singapore said on Friday that the incidents did not appear to be coordinated attacks targeting the country.
The Fullerton Health breach is the latest in a string of data incidents to hit Singapore in recent weeks, and it underlines how even systems holding no medical or financial data can expose enough personal detail — names, identification numbers, addresses and phone numbers — to put people at risk of identity fraud.
