The 2018 SingHealth data breach was a data breach incident initiated by unidentified state actors, which happened between 27 June and 4 July 2018. During that period, personal particulars of 1.5 million SingHealth patients and records of outpatient dispensed medicines belonging to 160,000 patients were stolen. Names, National Registration Identity Card (NRIC) numbers, addresses, dates of birth, race, and gender of patients who visited specialist outpatient clinics and polyclinics between 1 May 2015 and 4 July 2018 were maliciously accessed and copied. Information relating to patient diagnosis, test results and doctors' notes were unaffected. Information on Prime Minister Lee Hsien Loong was specifically targeted.
Discovery The database administrators for the Integrated Health Information Systems (IHIS), the public healthcare IT provider, detected unusual activity on one of SingHealth's IT databases on 4 July, and implemented precautions against further intrusions. Network traffic monitoring was enhanced; additional malicious activity was detected after 4 July, but did not result in the theft of any data. Having ascertained that a cyberattack occurred, administrators notified the ministries and brought in the Cyber Security Agency (CSA) on 10 July to carry out forensic investigations. The agency determined that perpetrators gained privileged access to the IT network by compromising a front-end workstation, and obtained login credentials to access the database, while hiding their digital footprints. The attack was made public in a statement released by the Ministry of Communications and Information and Ministry of Health on 20 July. The ten-day delay between the discovery of the attack and the public announcement was attributed to time needed to fortify the IT systems, conduct preliminary investigations, identify affected patients and prepare the logistics of the announcement. Text messages were subsequently sent to patients whose data was affected.
Investigation On 6 August 2018 in Parliament, Former Minister for Communications and Information, S. Iswaran, attributed the attack to sophisticated state-linked actors who wrote customized malware to circumvent SingHealth's antivirus and security tools. Iswaran did not name any state in the interest of national security.
A Committee of Inquiry was convened on 24 July 2018 to investigate the causes of the attack and identify measures to help prevent similar attacks. The four-member committee is chaired by former chief district judge Richard Magnus, and comprise leaders of a cyber-security firm, a healthcare technology firm and the National Trades Union Congress respectively. The committee called on the Attorney-General's Chambers to lead evidence, and the Attorney-General's Chambers appointed the Cyber Security Agency to lead the investigations with the support of the Criminal Investigation Department. The committee held closed-door and public hearings from 28 August, with another tranche of hearings from 21 September to 5 October. In addition, the Personal Data Protection Commission investigated into possible breaches of the Personal Data Protection Act in protecting data and hence determine possible action.
Committee of Inquiry hearings The Committee of Inquiry hearings began on 21 September 2018. In the first hearing, Solicitor-General Kwek Mean Luck said that a series of staff missteps and gaps in the system contributed to the breach. Some examples mentioned are the EMR system, which was in place since 1999. In addition, it was mentioned that the cyberattacker behind the incident started infecting workstations as early as August 2017 using a hacking tool. The version of Microsoft Outlook being used did not have a patch that prevents attacks by that hacking tool. Between December 2017 and May 2018, the cyberattacker moved sideways and gained access to a workstation to infect other computers with malware. Other inadequacies identified include not being able to identify multiple failed attempts to log into the system, which was done with non-existent accounts or accounts that do not have much privileges in the system. Eventually, the cyberattacker successfully gained entry through a coding vulnerability on 26 June, and hence sent SQL queries until 4 July when it was stopped by an administrator. In addition, there were three periods where staff failed to respond or responded after a few days when knowledge of the cyberattack was first known. On the same day, two staff members said that while a framework was in place to report cyberattacks, there is insufficient training on what to do, hence it was unclear to staff about what actions should be taken.
At the next hearing on 24 September, it was revealed that Prime Minister Lee Hsien Loong's personal data and outpatient records along with two other unnamed people were searched by hackers who infiltrated into the servers using NRIC numbers. The rest of the queries were generally done on patient demographic data, like one that involved the first 20,000 records of such data from Singapore General Hospital. An assistant lead analyst who detected unusual activity investigated further even through that was not his scope, and sent alerts to different divisions to find the staff who can make sense of those queries. The analyst's supervisor told the analyst to continue monitoring the situation and that he assumed there was no medical data until being informed that there was such a leak. As the analyst informed a reporting officer, there was no point in reporting the query himself, asking the analyst to follow up on the queries. Details about reporting procedures and containment measures were mentioned.
On the third day, a cybersecurity employee at IHiS, who was on holiday when the incident happened, did not follow up after having read the emails as it was thought to have been collection of data from workstations for investigation. In addition, only one computer at IHiS was used to carry out forensic examinations, resulting in delays diagnosing the issue. This is confirmed by the fourth day of the trial, where failings of judgement and organisational processes are exposed. For instance, meetings with the security management department were not conducted regularly, and no framework was created to set out appropriate responses to cybersecurity risks or to appoint covering officers if any staff go on leave. A clarification on processes was provided, where a standard operating procedure to escalate incidents was approved by the management in March 2018. It was also revealed the same day that staffers took six more days after 4 July to confirm the data breach as an IHiS employee mistakenly informed colleagues that no data was stolen, only confirmed after further tests are run by the superior finding that data was stolen. The queries were later recreated.
It was also revealed on the fifth day that a server exploited by hackers did not receive security updates in more than a year since May 2017 due to the WannaCry ransomware attacks, compared to the normal duration where patches were done several times a month. Besides that, the computer's anti-virus software was too old and need to be reinstalled. The manager was not supposed to manage the server on paper, but in practice, was given the role in 2014 as the server was located at the National Cancer Centre Singapore, thereby being convenient for staff members to approach him in case help was needed. Once the counterparts resigned, there was no one at IHiS present to take over managing the server. Also, the IHiS director was not aware that the server was not managed by the firm in practice, only giving a directive in 2014 that IHiS will not manage research servers. The next day, a security loophole that was not plugged was scruntised. Even though the loophole was flagged by an IHiS employee, there was no action taken. In fact, the employee was dismissed after sending details of the flaw to a rival company.
Towards the end of the second tranche of hearings on 5 October, it was revealed a second attempt to hack into the servers was done on 19 July via another server. This was stopped immediately as soon as it began. In addition, malware used was customised for the system and evaded detection from top anti-virus software. A tool called PowerShell was used in the process, being disabled on 13 July. Meanwhile, IHiS stepped up security with changing passwords, removing compromised accounts and rebooting servers.
The third tranche of hearings started on 31 October. Evidence was shown that managers were reluctant to report the incidents as that would mean an increased amount of work, thereby creating a bottleneck. Meanwhile, the chief information officer told the team to escalate the incident, saying a bottleneck is not acceptable, adding that there was no written protocol on how to report SingHealth-related cybersecurity incidents should IHiS staff discover any incident. Another pointed out that annual cybersecurity exercises are mandated for critical information infrastructure (CII) operators, so staff should be able to identify advanced persistent threats (APTs). However, these tests were for classroom settings and may not necessarily apply to the SingHealth case, thus defeating the purpose of these exercises if situational awareness was not there. There were also plans for secure Internet browsing in the healthcare sector by 2018, but it had to be delayed by a year due to technical issues.
The following day, a 2016 audit that found systemic weaknesses in the network link between Singapore General Hospital and cloud-based systems was brought up, showing more inadequacies in the systems managed by IHiS. The incident was reported by the operations team as "plugged" to the management without anyone verifying that works to fix these vulnerabilities were done. The Cyber Security Agency also found similar vulnerabilities in its investigation. Due to this, there will be "three lines of defence", where compliance checks are performed by the operations team, technology team and internal audit team, and training will be stepped up in IHiS so that early detection of attacks are ensured. As pointed out the next day that even if the weaknesses were found, they may not be fixed as quickly as expected as public healthcare institutions operate around the clock resulting in little downtime.
Later in the hearings, SingHealth executives said that they will enhance cyber safety awareness for all employees, as well as roll out new systems to capture patients' data rigorously. It will also allow patients to update their particulars instead of only doing it over the counter. More townhalls will be held to update employees about the latest cyber threats, with log-in messages strengthened to hone the importance of data protection. Storytelling formats will also be used to explain these concepts. More cyber security exercises simulating data breaches were called for in a subsequent hearing, with these allowing professionals to be more familiar with what to do in case a similar incident happens again. In addition, the expert recommended all data within the system to be encrypted including inactive data. As full encryption would be unfeasible due to operational concerns, personal data could be anonymised instead with 2-factor authentication to de-anonymise it. That same hearing, it was updated that many of the written submissions were found to be useful.