Fullerton Health Says 140,000 Migrant Worker Records Affected in Cybersecurity Incident

Fullerton Health migrant worker data breach Singapore, Digi Mart USA News (Singapore): About 140,000 work pass holder records were compromised in a cybersecurity incident involving Fullerton Health’s Migrant Worker Primary Care Plan (PCP) programme, the healthcare provider said on Saturday (Nov 14), according to a response to queries from CNA. About 43,000 of those records belonged to individuals whose work passes were no longer valid.

Fullerton Health had said in a Nov 9 notice on its website that it became aware of the breach on Oct 31, but did not disclose the number of workers affected at the time. Preliminary investigations indicated that migrant workers’ full names, foreign identification numbers, dates of birth, mobile numbers, email addresses and residential addresses may have been affected.

The company said no health, medical or personal financial information was compromised.

Fullerton Health said its security monitoring provider, Logicalis, found no evidence of abnormalities or security breaches across the IT assets under its monitoring, based on a preliminary probe. The company said it isolated the affected server supporting the PCP programme after discovering the incident and is building an entirely new server with security measures in place from the outset to serve as a new PCP Enrolment Portal, so the affected server will not be reused.

The company said it has made two rounds of notifications to affected migrant workers through their employers, and advised them to be cautious about unsolicited emails, calls, text messages or other requests for personal information. The Ministry of Manpower has also notified affected workers directly through its FWMOMCare mobile application, with notifications provided in workers’ native languages.

The incident is one of several recent reported data breaches involving Singapore healthcare and other organisations. The Personal Data Protection Commission said on Friday that the recent spate of breaches appears to have resulted from opportunistic attacks exploiting common IT vulnerabilities, with no clear connection between them.

The Cyber Security Agency of Singapore said the average monthly number of reported cyber incidents since September has been three times the January to August average, but the incidents do not appear to be part of coordinated campaigns targeting Singapore.