Data of over 4,000 healthcare, community care employees potentially accessed in AIC cybersecurity incident

SINGAPORE: The personal data of up to 4,064 employees from public healthcare institutions and community care providers may have been accessed by an unauthorised third party following a cybersecurity incident, the Agency for Integrated Care (AIC) said on Thursday (Nov 12).

The incident was detected on Nov 10 and involved the Advance Care Planning (ACP) IT System, AIC added.

The data that may have been accessed includes names, contact numbers, email addresses and NRIC numbers.

AIC said there are no indications that medical records or patient data have been compromised and no other systems have been affected.

The ACP IT System is used by ACP facilitators to help members of the public document their ACPs.

These facilitators are trained to conduct discussions and guide individuals in making decisions about their future care preferences.

AIC said it lodged a police report on Nov 10 and reported the incident to the Cyber Security Agency of Singapore (CSA).

As a precaution, the ACP IT System was taken offline on the same day while investigations were conducted.

The system was restored on Thursday.

During the disruption, ACP facilitators were advised to continue documenting using physical forms.

AIC said it will continue to investigate the incident and conduct a thorough review of its systems. It added that it work with CSA to implement immediate measures to strengthen its cyber defences.

The agency will also contact all potentially affected individuals within the next three days.

Those affected are advised to remain cautious about suspicious or unsolicited emails, messages and phone calls.

They should also avoid sharing personal information, passwords or one-time passwords with anyone whose identity they cannot verify.

Individuals who suspect that they may be affected by this incident may contact AIC at 1800-650-6060 or email enquiries [at] aic.sg.

Investigations into the incident are ongoing.