110,000 Alliance Medinet members caught up in cyber incident
Nearly 4,400 customers of three insurers were affected or potentially affected after unauthorised access to Alliance Medinet's membership database.
A cyber incident has ensnared roughly 110,000 people who belong to Alliance Medinet, a healthcare services provider, and the affected include customers of three well-known insurers. Customers of HSBC Life, Income Insurance and Singlife number among those hit, as the compromised personal data covers roughly 110,000 members.
If you have a policy with one of those insurers, here is what is known so far.
What happened and what data may be involved
Nearly 4,400 customers of the three insurers were affected, or may have been, according to the companies. Someone gained unauthorised access to the membership database of Alliance Medinet.
On Saturday (Oct 24), parent company Alliance Healthcare Group stated in a filing to the bourse that names, personal identification numbers and contact details are among the data possibly compromised.
The group also flagged two more serious items. Seven members' bank account details, along with a single member's medical diagnosis, may have been compromised as well.
Specialising in managed healthcare and third-party administration services, Alliance Medinet serves as the corporate healthcare arm of Alliance Healthcare Group. Several insurers receive services from it.
Who is affected, insurer by insurer
HSBC Life has the biggest number. Among those affected, according to the insurer, were 2,614 individual policyholders as well as 1,381 members covered by group corporate policies.
HSBC Life stated in a notice that CNA has seen that names, personal identification numbers and contact details were among the data potentially compromised. Although investigations were still under way, the insurer stated its understanding was that medical records faced no risk.
Income Insurance's number is smaller. According to the insurer, one of its corporate accounts was hit, and roughly 70 individuals were involved.
Names, personal identification numbers, mobile numbers, policy numbers, plus the start and end dates of coverage, were among the information potentially affected. "There is currently no evidence that bank account information or medical information has been compromised," Income Insurance said on Saturday.
Singlife is next. The insurer stated that 323 customers covered by its Employee Benefits group health insurance may have been affected.
Policy information, company names, corporate email addresses, contact numbers, dates of birth, NRIC numbers and names were all part of the data potentially compromised. "There is currently no indication that any personal health or medical information is affected," Singlife said.
There may be more names to come. To find out if its customers were hit, CNA has reached out to Great Eastern, another user of Alliance Medinet's services.
What you should check
Alliance Medinet, its partners or the relevant clients were still notifying the members concerned. So keep an eye out for a message from your insurer or employer.
Policyholders were advised by HSBC Life to stay alert to scams and phishing attempts, and the insurer added that affected individuals and distribution partners had already been informed. Steps to notify those affected had been taken, according to Income Insurance. According to Singlife, affected customers had been contacted.
Regarding access to your policy, HSBC Life emphasised that policyholders could keep using their benefits as usual and that its own systems had not been compromised. Login credentials and passwords were not affected, Alliance Medinet had also advised. No evidence exists that their own systems were compromised, according to all three insurers.
What the company and regulators are doing
Upon discovering the incident, the parent group said it moved at once to contain it, and it brought in independent cybersecurity and forensic specialists for the investigation.
While tightening its IT systems, processes and security controls, it has also put in place network monitoring and dark web monitoring systems that run around the clock. Its other subsidiaries, it added, were unaffected.
On Oct 21, the matter was reported to the Personal Data Protection Commission in Singapore. The commission said on Saturday that it is aware and investigating. Developments were being closely monitored, said the Cyber Security Agency of Singapore, which added that it knew of the incident.
A more complete update would follow in due course, the group said.
