On Tuesday (19 March), Russian cyber-security company Group-IB divulged its discovery of employees’ email log-ins and passwords from several government organisations on the dark Web since 2017.
On top of that, over 19,000 compromised payment card details, which was said to be valued at more than $600,000, were stolen last year and put up for sale online by the hackers.
The press release issued by Group-IB mentioned that the organisations involved included the Government Technology Agency (GovTech), Ministry of Education, Ministry of Health and the Singapore Police Force, as well as the National University of Singapore.
A Smart Nation and Digital Government Group spokesman informed The Straits Times that GovTech was alerted to the presence of e-mail credentials in illegal data banks in January this year.
The spokesman said: “These credentials comprise e-mail addresses and passwords provided by individuals. Around 50,000 of these are government e-mail addresses. They are either outdated or bogus addresses, except for 119 of them which are still being used.
“As an immediate precautionary measure, all officers with affected credentials have changed their passwords. There are no other information fields exposed apart from the e-mail address and password.”
He added that officers were reminded not to use government e-mail addresses for personal and non-official purposes “as part of basic cyber hygiene” because this gave the hackers a loophole in accessing their credentials.
Mr Dmitry Volkov, the chief technology officer and head of threat intelligence at Group-IB, said the compromised credentials could be used for cybercrime and spying, “either sold in underground forums or used in targeted attacks on government agencies for the purpose of espionage or sabotage.”
“Even one compromised account, unless detected at the right time, can lead to the disruption of internal operations or leak of government secrets,” he cautioned.
Group-IB also said that Singapore is “drawing more and more attention” from hackers with financial intentions every year.
Following a string of breaches and cyber attacks in the public and private sectors, data research showed that the number of leaked cards increased by 56 per cent last year compared to 2017.
Last June, the country’s worst cyber attack involved the personal data breach of 1.5 million patients of healthcare cluster SingHealth, including Prime Minister Lee Hsien Loong.
Other breaches included the illegal access of 72 HealthHub accounts last October, the online leak of personal information of 14,200 HIV patients and the unauthorized access of data belonging to more than 800,000 blood donors by a vendor just last week.
Earlier this month, The Straits Times also reported that insurance company AIA was checking all its systems after one of its Web portals containing the personal information of more than 200 people was found to be publicly accessible.
