Fullerton Health hit by cyber attack, personal data of migrant workers exposed

Integrated healthcare solutions provider Fullerton Health has been hit by a cyber attack, with personal data of participants of its Ministry of Manpower (MOM)-administered Migrant Worker Primary Care Plan (PCP) programme possibly affected.

In a statement posted on its website, Fullerton Health said it became aware of the incident involving unauthorised access to a server supporting the programme on Oct 31, adding that incident response protocols were immediately activated, while precautionary measures were implemented across its network to secure systems.

Investigations are ongoing.

"Fullerton Health has notified the Personal Data Protection Commission. We have also made a police report and are also in contact with MOM," said the healthcare provider, adding that it is cooperating fully with the relevant authorities.

Notwithstanding the incident, Fullerton Health stated that its managed care services, healthcare services, and facilities remain operational.

Initial findings

The healthcare provider said that its current assessment indicates that the incident appears to be limited to a specific standalone system supporting the PCP programme.

There is no evidence now that systems supporting other programmes, projects, clients or patients have been affected, it said.

In terms of data breach, the healthcare provider said the name, Foreign Identification Number, date of birth, mobile number, email address and residential address of migrant workers may have been affected.

But the affected data does not contain any health, medical, or personal financial information of the workers.

Fullerton Health said it is taking proactive steps to notify affected migrant workers and provide them with information on the incident, including where they can seek further information.

"We recognise that some individuals may require additional support in understanding how they have been affected and what precautionary steps they can take to protect themselves. 

"Fullerton Health will provide guidance as part of the notification process," it added, reiterating that protecting personal information is one of its highest priorities.

This is the second reported incident of a data breach involving a healthcare services provider in less than seven days.

On Nov 6, it was reported that Doctor Anywhere had suffered what it described as a "malicious cyber incident" that resulted in the leak of personal data of its users.

[[nid:750409]]

editor@asiaone.com