Personal data of 110,000 members compromised in Alliance Medinet cyber incident

Alliance Medinet provides services to several insurers, including HSBC Life, Singlife and Income Insurance, which have reported being affected by the incident.

This audio is generated by an AI tool.

SINGAPORE: The personal data of 110,000 members of healthcare services provider Alliance Medinet has been compromised in a cybersecurity incident involving unauthorised access to its membership database.

The potentially affected data includes names, personal identification numbers and information, parent company Alliance Healthcare Group said in a bourse filing on Saturday (Oct 24).

It added that bank account information belonging to seven members and one member's medical diagnosis might also have been compromised.

"Based on investigations conducted to date, the personal data of approximately 110,000 members in that membership database have been compromised by a third-party," it said.

CNA Games Guess Word Crack the word, one row at a time Buzzword Create words using the given letters Mini Sudoku Tiny puzzle, mighty brain teaser Mini Crossword Small grid, big challenge Word Spot as many words as you can Show More Show Less Alliance Medinet is the corporate healthcare arm of Alliance Healthcare Group, specialising in managed healthcare services and third-party administration services, among others. The group said affected members were in the process of being notified by Alliance Medinet, its partners or relevant clients. Other subsidiaries of Alliance Healthcare Group were not affected by the incident, it added. In response to CNA's queries, the Cyber Security Agency of Singapore said it was aware of the incident and monitoring developments closely. INSURERS AFFECTED Several insurers using Alliance Medinet's services said that they had been affected by the incident. In a notice seen by CNA, HSBC Life said 2,614 individual policyholders and 1,381 members under group corporate policies were affected. The potentially affected data included their names, NRIC numbers, dates of birth, email addresses, mobile numbers and information on their policies, including the policy's name and benefits, it said. Customers could still access the Benefits Hub app, as Alliance Medinet had indicated that login credentials were unaffected, it added. Income Insurance said in a press release on Saturday that the incident affected one of its corporate accounts, involving 70 individuals. The insurer said names, personal identification numbers, mobile numbers, policy numbers and coverage start and end dates were among the potentially affected data. “There is currently no evidence that bank account information or medical information has been compromised,” it said, adding that steps have been taken to inform those affected. Meanwhile, insurance provider Singlife said 323 customers under its Employee Benefits group health insurance could have been affected. The potentially affected data included names, NRIC numbers, dates of birth, numbers, corporate email addresses, company names and policy information. "There is currently no indication that any personal health or medical information is affected," Singlife said. Affected Singlife customers have already been contacted. All three insurers said there was no evidence that their own systems were compromised. CNA has reached out to Great Eastern, which also uses Alliance Medinet’s services, to ask if their customers were affected.

Alliance Medinet is the corporate healthcare arm of Alliance Healthcare Group, specialising in managed healthcare services and third-party administration services, among others.

The group said affected members were in the process of being notified by Alliance Medinet, its partners or relevant clients.

Other subsidiaries of Alliance Healthcare Group were not affected by the incident, it added.

In response to CNA's queries, the Cyber Security Agency of Singapore said it was aware of the incident and monitoring developments closely.

Several insurers using Alliance Medinet's services said that they had been affected by the incident.

In a notice seen by CNA, HSBC Life said 2,614 individual policyholders and 1,381 members under group corporate policies were affected.

The potentially affected data included their names, NRIC numbers, dates of birth, email addresses, mobile numbers and information on their policies, including the policy's name and benefits, it said.

Customers could still access the Benefits Hub app, as Alliance Medinet had indicated that login credentials were unaffected, it added.

Income Insurance said in a press release on Saturday that the incident affected one of its corporate accounts, involving 70 individuals.

The insurer said names, personal identification numbers, mobile numbers, policy numbers and coverage start and end dates were among the potentially affected data.

“There is currently no evidence that bank account information or medical information has been compromised,” it said, adding that steps have been taken to inform those affected.

Meanwhile, insurance provider Singlife said 323 customers under its Employee Benefits group health insurance could have been affected.

The potentially affected data included names, NRIC numbers, dates of birth, numbers, corporate email addresses, company names and policy information.

"There is currently no indication that any personal health or medical information is affected," Singlife said. Affected Singlife customers have already been contacted.

All three insurers said there was no evidence that their own systems were compromised.

CNA has reached out to Great Eastern, which also uses Alliance Medinet’s services, to ask if their customers were affected.

ONGOING INVESTIGATION

Alliance Healthcare Group said its team acted immediately to contain the incident after discovering it.

It engaged independent cybersecurity and forensic specialists to support a formal investigation and further strengthen its IT systems, processes and security controls.

"Investigations are currently ongoing," it said, adding that 24-hour network monitoring and dark web monitoring systems had been put in place.

The incident was reported to Singapore's Personal Data Protection Commission on Oct 21.

"Protecting the information entrusted to us is a responsibility we take very seriously, and we remain committed to working closely with all parties to resolve the matter," it said.

The group said it would provide a fuller update in due course, and would keep shareholders updated of any material development.

It also advised shareholders to exercise caution when dealing in its shares or securities and to seek professional advice where necessary.

Stay updated with notifications for breaking news and our best stories

Join our channel for the top reads for the day on your preferred chat app