Singapore's healthcare cyber breaches expose growing risks beyond hospitals, warn experts

Singapore

Six of 10 reported data breaches in the past two months involved healthcare-related organisations, highlighting concerns over cybersecurity risks across an increasingly interconnected sector.

New: You can now listen to articles.

This audio is generated by an AI tool.

13 Nov 2026 05:45PM

SINGAPORE: A recent spate of cyber incidents involving healthcare organisations in Singapore points to a broader shift in the threat landscape, with hackers increasingly targeting not just hospitals but also clinics, telehealth platforms and third-party service providers that handle sensitive healthcare data, experts said. 

In the past two months, 10 cybersecurity breaches involving compromised information have been reported, six of which were healthcare-related. 

While experts CNA spoke to stopped short of describing the incidents as a coordinated campaign, they said malicious actors are increasingly exploiting vulnerabilities across an interconnected healthcare ecosystem that holds valuable personal data and depends heavily on uninterrupted digital services.

"This pattern is not coincidental," said Mr Andrew Kay, senior director of systems engineering at cybersecurity firm Illumio. 

"Threat actors prioritise sectors where data is valuable and operational pressure is high, and healthcare meets both criteria."

CYBERATTACKS INCREASINGLY OPPORTUNISTIC: CSA

In a statement on Friday (Nov 13), the Cyber Security Agency of Singapore (CSA) said the recent string of cyber incidents reflects "a broader global trend of opportunistic attacks", rather than coordinated campaigns targeting Singapore.

The average monthly number of reported cyber incidents since September has been three times the January to August average, it said. 

"Threat actors actively scan the internet for vulnerable systems, and organisations can become victims even if they are not specifically targeted," CSA said, urging organisations to strengthen their cyber defences.

In a statement on Thursday, the Ministry of Health (MOH) said it is taking the recent spate of cybersecurity incidents across the healthcare sector very seriously. 

“To our knowledge, there had not been unauthorised access of patient health records in these breaches,” the ministry added.

Associate Professor Razwana Begum from the Singapore University of Social Sciences (SUSS) said the range of organisations affected was particularly concerning. 

"What stands out is the range of organisations affected, from healthcare providers to telemedicine platforms and third-party healthcare administrators," she said. 

The concern goes beyond the frequency of attacks to the growing number of systems and service providers handling sensitive healthcare-related information, she added. 

"As these systems become more interconnected, vulnerabilities in one organisation can potentially expose information belonging to several others.”

Healthcare is becoming increasingly dependent on interconnected digital systems, including electronic health records, telemedicine, cloud platforms and connected medical devices, said Assoc Prof Razwana. 

“While these technologies improve efficiency and patient care, they also introduce additional vulnerabilities that attackers may exploit.”

HEALTHCARE DATA A "GOLD MINE"

Healthcare providers are "goldmines" for hackers because they hold permanent personal data such as NRIC numbers, home addresses, insurance details, and medical histories, said Mr Ali Fazeli, director of Infinity Forensics. 

Unlike credit card numbers or passwords, much of this information cannot easily be changed after a breach, making it particularly valuable to cybercriminals. 

"The massive financial value of medical records makes healthcare a prime target on the dark web," said Mr Ali.

He said cybercriminals pay high prices for this sensitive data to run convincing identity theft schemes, scams, and extortion.

"On top of that, clinics and hospitals run life-or-death operations, so they cannot afford system downtime and are far more likely to pay ransoms quickly to restore access," added Mr Ali. 

Recent healthcare data breaches

Oct 24: Alliance Medinet

Personal data of about 110,000 members was compromised after unauthorised access to its membership database, including names, identification numbers and contact details. Bank details of seven members and one member’s medical diagnosis might also have been affected. Nearly 4,400 customers of HSBC Life, Income Insurance and Singlife were affected or potentially affected.

Nov 6: Doctor Anywhere

Users’ personal data was leaked in a cyber incident involving an unknown third party. Doctor Anywhere, which became aware of the breach on Oct 29, did not disclose how many users or what data were affected, but said clinical records were not compromised.

Nov 9: Fullerton Health

A server supporting its Migrant Worker Primary Care Plan programme was accessed without authorisation. Fullerton Health did not disclose how many workers were affected, but said names, FIN numbers, dates of birth and contact details may have been exposed, while health, medical and financial information were not affected.

Nov 11: Dementia Singapore’s CARA SG app

Some CARA SG members’ personal data may have been compromised after a cyber incident that saw unauthorised app notifications being sent on Nov 1. Names, email addresses, phone numbers and membership IDs may have been affected, but no NRIC numbers were compromised.

Nov 11: Minmed Group

A standalone system supporting Minmed’s teleconsultation and health screening services was hit by a “malicious cybersecurity incident”. The group did not disclose the number of people or types of personal data affected, but said clinical records were not compromised.

Nov 12: Agency for Integrated Care (AIC)

An unauthorised third party accessed AIC’s Advance Care Planning IT system, potentially compromising the personal data of up to 4,064 staff from public healthcare institutions and community care providers. Names, contact details and NRIC numbers may have been affected, but no indications were found that medical records or patient data had been compromised.

Collapse Expand

HACKERS LOOKING FOR 'SIDE ENTRANCES'

The rapid growth of digital healthcare services has created more potential entry points for attackers, particularly through third-party platforms and service providers, experts said. 

"Instead of wasting time trying to break down the front doors of heavily guarded networks, hackers now look for easy side entrances," said Mr Ali. 

He noted that the widespread adoption of mobile health applications, remote consultation portals and cloud storage has "vastly expanded the attack surface", referring to the number of potential entry points that hackers can exploit. 

"A single security gap, such as a misconfigured cloud server or a weak third-party vendor connection, is often all it takes for intruders to break in and access large volumes of sensitive patient data," he said. 

Experts said artificial intelligence (AI) could make existing cyberattack methods faster and easier to scale, including by helping attackers identify vulnerabilities, generate malicious code and produce more convincing phishing messages.

However, Professor Wang Huaxiong of Nanyang Technological University’s School of Physical and Mathematical Sciences cautioned that there was no evidence so far that AI had been used in the six recent healthcare incidents, and said its role should not be assumed without forensic evidence.

Assoc Prof Razwana said another concern is healthcare institutions’ growing reliance on third-party technology providers. 

Many institutions outsource functions such as cloud hosting, clinic management systems, telemedicine, payment processing and healthcare administration, she said. 

"These arrangements can introduce vulnerabilities that are not always visible to the healthcare provider," she added. 

Citing equipment such as infusion pumps and imaging systems, as well as building management controls in a hospital, Mr Kay said every connected device represents a potential entry point for attackers.

"Any device connected to the network must be treated as part of the attack surface,” he said. 

WHAT SHOULD HEALTHCARE FIRMS DO?

Experts said healthcare providers must look beyond preventing cyberattacks and strengthen their ability to detect and contain breaches. 

"Cybersecurity awareness is necessary, but it is no longer sufficient on its own," said Assoc Prof Razwana. 

What matters is whether organisations have implemented effective controls and can demonstrate they work, she added. 

Mr Kay similarly stressed the importance of containing intrusions before attackers can spread through an organisation’s systems. 

"The decisive factor is not whether an attacker gets in, but how quickly the organisation can contain them once they do," he said. 

Experts said healthcare providers should assess their suppliers’ security themselves, limit vendors’ access to only what they need, and require them to report breaches promptly.

“Outsourcing a service does not remove the need to understand what data a supplier holds, who can access it and how an incident will be detected and contained,” said Prof Wang.

Other priorities include strong authentication, prompt remediation of known vulnerabilities, tighter controls over administrator and vendor access, and network segmentation to limit the spread of attacks. 

Organisations should also monitor for suspicious activity, including unusual access patterns and large data transfers, Prof Wang added.

AI can also help defenders review code, monitor systems and flag vulnerabilities, said Mr Ali. But he cautioned that such tools are not a “silver bullet” and can introduce new security risks if they are not properly configured and managed. 

However, Assoc Prof Razwana said cybersecurity preparedness is unlikely to be uniform across the healthcare sector. 

While larger private healthcare groups may have dedicated cybersecurity teams and greater resources to invest in protective technologies, smaller clinics and independent providers may face tighter budgets and limited access to technical expertise. 

They often depend heavily on external vendors to manage their IT systems, making the security of those providers particularly important, said Assoc Prof Razwana.

Heavy reliance on common service providers can also create concentration risk, she said, as a compromise at one widely used provider could potentially affect several healthcare organisations.  

In response to CNA’s queries, Raffles Medical Group chief technology officer Terence Foo said it regularly reviews and strengthens its cybersecurity practices in line with the evolving landscape. 

These efforts include ongoing assessments of the system security, risk management and disruption preparedness, as well as working closely with technology partners and vendors.

"While we do not comment on specific measures, monitoring activities or threat assessments for security reasons, we remain attentive to risks and continue to take a risk-based approach on cybersecurity," he said. 

"We are committed to protecting patient information and maintaining business continuity to support the safe and continued delivery of essential healthcare services."

But even with such safeguards in place, no organisation can guarantee complete protection against cyberattacks, said experts. 

Assoc Prof Razwana said the more realistic objective is to make successful intrusions harder, limit their impact and ensure that essential healthcare services can continue even when systems are compromised. 

"The focus is not just about securing data,” she added. “It is about protecting patient trust, maintaining continuity of care and safeguarding patient safety."

Source: CNA/nl