Over 120,000 individual's data compromised in two malware incident, including that of over 100,000 MINDEF/SAF personnel
The Ministry of Defence (MINDEF) and Singapore Armed Forces (SAF) have experienced malware incidents involving the personal data of several thousand MINDEF/SAF personnel as two of its vendors, HMI Institute of Health Sciences and ST Logistics, reported data breaches in their systems. In a statement on 21 December, MINDEF said that HMI Institute of Health Sciences (HMI Institute) has been contracted by the SAF since 2016 and ST Logistics has been a vendor since 1999. Both were provided with the personal data of MINDEF and SAF personnel for the provision of their services. On 21 December, HMI Institute announced in a statement that it discovered a file server that was encrypted by ransomware of 4 December which contained the personal data of over 120,000 individuals including full names, NRIC numbers, date of birth, home addresses and email addresses. Among those, approximately 98,000 are SAF servicemen who attended the Cardio Pulmonary Resuscitation (CPR) and Automated External Defibrillation (AED) course provided by HMI Institute. HMI Institute, owned by Health Management International, noted that the server was immediately taken offline and isolated from the internet and internal network. They then engaged a cybersecurity firm to investigate the incident. It was found that the attack was random and opportunistic, though there was no evidence to show that the data on the affected server was copied or exported. The statement said that there is a “low likelihood of a data leak”. Mr Tee Soo Kong, Executive Director, HMI Institute of Health Sciences said: “We take this incident very seriously and we deeply apologise to the students and applicants affected and for the inconvenience caused. Preserving their privacy and keeping their personal data safe are our highest priorities.” He added, “We have also put in place additional measures to fortify our systems against increasingly sophisticated cyber intrusions.” As for ST Logistics, the company said the breach it experienced was a result of email phishing activities sent to its employees’ email accounts. “This data, contained in working files residing in affected workstations, may have been exfiltrated,” it said. The affected systems contained the full names and NRIC numbers as well as a combination of contact numbers, emails and residential addresses of about 2,400 MINDEF/SAF personnel. In this case, MINDEF said that preliminary investigations indicate that personal data could have been leaked. ST Logistics, which is owned by Japan Post, added that it has carried out “extensive forensic investigations” via its own cybersecurity team supported by external cybersecurity experts. Both companies reported the incidents to the Personal Data Protection Commission (PDPC) and the Singapore Computer Emergency Response Team (SingCERT). PDPC is investigating both cases. MINDEF said, “MINDEF and the SAF take a serious view on the secure handling of personal data by our vendors. The security of their IT systems is an important factor that will be taken into account in the award of contracts.” It added that it is engaging other vendors who hold MINDEF/SAF personnel information to strengthen the security of their IT systems. Defence Cyber Chief Brigadier-General Mark Tan said, "The malware incidents affected the IT systems of our vendors. Although MINDEF/SAF's systems and operations were not affected, the malware incidents in these vendor companies may have compromised the confidentiality of our personnel's personal data. We will review the cybersecurity standards of our vendors to ensure that they are able to protect our personnel's personal data and information." MINDEF notes that affected personnel are being notified of the breach from 21 December onwards.
