Singapore-listed Alliance Healthcare Group has disclosed that a cyber incident at its subsidiary Alliance Medinet compromised the personal data of about 110,000 members. The disclosure came in a filing to the Singapore Exchange on Saturday 24 October, and the incident had already been reported to Singapore's Personal Data Protection Commission on 21 October.

What was exposed

According to the filing, a third party gained unauthorised access to the system holding Medinet's membership database. The data involved includes names, personal identification numbers and contact information. On the company's initial assessment, bank account information for seven members and a medical diagnosis for one member might also have been compromised. The company has not said how the intruder gained access, and that detail remains unconfirmed.

Insurers' customers affected

Medinet provides managed healthcare and third-party administration services, and several insurers have said their customers are among those affected. Reports naming HSBC Life, Income Insurance and Singlife say nearly 4,400 of their customers were affected or potentially affected. One report put about 70 people in a single Income Insurance corporate account within that total. Affected members are being notified by Medinet, its partners or the relevant clients.

Response and investigation

The group said it contained the incident on discovery and brought in independent cybersecurity and forensic specialists to investigate. It has added round-the-clock network monitoring and dark web monitoring, and said the rest of the group was not affected. Singapore's Cyber Security Agency said it was aware of the incident and monitoring developments. The investigation is continuing, and the company said it would provide a fuller update in due course.