No further compromise to Alliance Medinet's system, hacker access blocked, says parent company

SINGAPORE — The cybersecurity breach into healthcare services provider Alliance Medinet’s membership database has been contained, with no further compromise detected across its information system, its parent company said on Oct 26.

The announcement follows an Oct 24 disclosure that about 110,000 members had their personal data compromised in a cyber incident involving unauthorised access to Alliance Medinet’s database.

In an update to shareholders on Oct 26, parent company Alliance Healthcare Group said it has appointed KPMG Services as “independent cybersecurity and forensic specialists” to look into the incident.

“As at the date of this announcement, KPMG has validated the security fixes deployed by Medinet’s IT team and confirmed that the unauthorised access path used by the third party has been secured,” the group’s board said in its statement.

“At this point, there is no evidence of further compromise to Medinet’s information system.”

The board said KPMG will continue the investigation to determine the root causes, extent and impact of the incident.

In the update, the board said the data breach was limited to Alliance Medinet’s membership database. The group’s other systems, including its financial systems, were not affected by the breach.

Alliance Medinet — the corporate healthcare arm of Alliance Healthcare Group — specialises in managed healthcare services, offering personalised corporate solutions and third-party administration services, according to its website.

The subsidiary was established in 2005 and has a network of more than 2,000 panel clinics in Singapore.

Cigna, Great Eastern, HSBC Life, Income Insurance, Singlife and Tokio Marine, which Alliance Medinet provides services to, were among those affected by the data breach.

Data potentially exposed in the breach included the full names, personal identification numbers, birth dates, contact information, policy details and employment information of Alliance Medinet database members.

In a bourse filing on Oct 24, Alliance Healthcare Group said the bank account information of seven members in the database and one member’s medical diagnosis might also have been compromised.

In response to media queries, the Cyber Security Agency of Singapore (CSA) had earlier said it was monitoring developments closely, while the Personal Data Protection Commission (PDPC) said it was investigating the incident.

The Straits Times has contacted CSA and PDPC for more information.

This article was first published in The Straits Times . Permission required for reproduction.

新加坡——医疗服务提供商 Alliance Medinet 的母公司于 10 月 26 日表示，该公司会员数据库遭受的网络安全攻击已被控制，其信息系统未发现进一步的损害。

此前，10 月 24 日披露，在一次涉及未经授权访问 Alliance Medinet 数据库的网络事件中，约有 11 万名会员的个人数据遭到泄露。

10 月 26 日，母公司 Alliance Healthcare Group 在向股东发布的最新消息中表示，已委任毕马威会计师事务所作为“独立的网络安全和取证专家”调查此次事件。

“截至本公告发布之日，毕马威已验证了 Medinet IT 团队部署的安全修复措施，并确认第三方使用的未经授权的访问路径已得到保护，”该集团董事会在声明中表示。

“目前，没有证据表明 Medinet 的信息系统遭到进一步破坏。”

董事会表示，毕马威将继续调查，以确定事件的根本原因、范围和影响。

在最新通报中，董事会表示，此次数据泄露仅限于Alliance Medinet的会员数据库。该集团的其他系统，包括财务系统，均未受到影响。

据其网站介绍，Alliance Medinet 是 Alliance Healthcare Group 的企业医疗保健部门，专门从事医疗保健管理服务，提供个性化的企业解决方案和第三方管理服务。

该子公司成立于 2005 年，在新加坡拥有超过 2000 家合作诊所。

受此次数据泄露事件影响的公司包括：Cigna、Great Eastern、汇丰人寿、Income Insurance、Singlife 和 Tokio Marine，Alliance Medinet 都为其提供服务。

此次泄露事件中可能泄露的数据包括Alliance Medinet数据库成员的全名、个人识别号码、出生日期、联系方式、保单详情和就业信息。

Alliance Healthcare Group 在 10 月 24 日提交给证券交易所的文件中表示，数据库中七名成员的银行账户信息和一名成员的医疗诊断信息可能也已被泄露。

针对媒体的询问，新加坡网络安全局 (CSA) 早前表示正在密切关注事态发展，而个人数据保护委员会 (PDPC) 则表示正在调查此事。

《海峡时报》已联系CSA和PDPC以获取更多信息。

本文最初发表于《海峡时报》。转载需获得许可。