Alliance Medinet Breach Hit 110,000 Members

The personal data of about 110,000 members of Alliance Medinet, a Singapore healthcare services provider that administers corporate medical benefits for insurers, has been compromised in a cyber incident, its parent company said on Saturday 24 October.

Alliance Healthcare Group said in a filing on the Singapore Exchange that the data potentially affected includes names, personal identification numbers and contact information, CNA reported. It said the bank account information of seven members and one member’s medical diagnosis might also have been compromised. “Based on investigations conducted to date, the personal data of approximately 110,000 members in that membership database have been compromised by a third-party,” the group said.

According to CNA and Lianhe Zaobao, the group said it acted immediately to contain the incident and engaged independent cybersecurity and forensic specialists to support a formal investigation. “Investigations are currently ongoing,” it said, adding that 24-hour network monitoring and dark web monitoring were in place. It reported the incident to Singapore’s Personal Data Protection Commission on 21 October. The group said its other subsidiaries were not affected, and that members were being told by Alliance Medinet, its partners or the relevant clients. The Cyber Security Agency of Singapore told CNA it was aware of the incident and monitoring developments.

The group had asked for a trading halt on 23 October, pending the release of an announcement. It told shareholders it would give a fuller update in due course.

In brief

What happened: Alliance Healthcare Group says personal data of about 110,000 Alliance Medinet members, including names, ID numbers and contact details, was compromised.
Why it matters: Alliance Medinet handles corporate health benefits for several insurers, so policyholders at different insurers are being contacted.
What’s unknown: When the access began, and how many members each insurer has in total.

Insurers say their own systems were not breached

HSBC Life said in a notice seen by CNA that 2,614 individual policyholders and 1,381 members of group corporate policies were affected, with names, identification numbers and contact details involved. It said it understood no medical records were at risk. Its own systems were not compromised, and customers can still use its Benefits Hub app, as Alliance Medinet had said login credentials and passwords were unaffected.

Singlife told CNA that 323 customers under its Employee Benefits group health insurance were affected. It said the data involved names, NRIC numbers, dates of birth, contact numbers, corporate email addresses, company names and policy information, and that “there is currently no indication that any personal health or medical information is affected”.

Income Insurance said Alliance Medinet, “a third-party administrator that provides healthcare-related services to our policyholders”, told it of unauthorised access to its membership database on 22 October. One corporate account, covering about 70 people, was affected. The data included names, identification numbers, mobile numbers, policy numbers and coverage dates. “There is currently no evidence that bank account information or medical information has been compromised,” Income said, adding that there was “no indication” its own systems were compromised.

Great Eastern said Alliance Medinet processes corporate employee benefits claims on its behalf. It has not said how many of its members were affected, but said the bank account information of three of them may have been compromised. Individual life, health, personal accident and general policies are not affected, and Great Eastern said its IT systems were not compromised. It has contacted affected members of its corporate schemes.

Members are being told to watch for scam calls and messages

The insurers’ advice to affected members is broadly the same. Income urges customers to treat links and attachments in unexpected messages claiming to come from it with suspicion, and never to share personal details, passwords or one-time passwords. It suggests checking bank accounts for anything unusual and calling the bank if something looks wrong. It also asks customers to scan only QR codes found in its official letters, emails or website. Customers can check with Income on 6788 1777, and scams can be reported to the National Anti-Scam Hotline on 1799 or through the ScamShield app.

Great Eastern says login details for its Great Benefits app were not affected, but suggests members consider changing their password anyway. It asks members to check any contact claiming to be from it by calling 1800-248-2888, between 9am and 5.30pm on weekdays. HSBC Life has told policyholders to be alert to scams and phishing and to change their app passwords regularly.

One administrator’s database held many insurers’ members

This is TSN’s analysis.

For most of the 110,000 people affected, the risk described so far is less about stolen money than about believable scams. A message that quotes someone’s name, identification number, employer and policy details can look like it comes from their insurer, which is why every insurer’s advice centres on checking before replying. The seven members whose bank details may be involved, and the one whose diagnosis may be, face a different and more personal risk, and the reports so far are silent on what extra help they will get.

The incident also shows how third-party risk works in practice. Each insurer says its own systems were untouched, yet their customers’ data was still exposed because it sat with a shared administrator. For compliance teams, that is the point of vendor due diligence: an insurer can delegate claims handling, but members will still look to the insurer when something goes wrong. The insurers have each published their own figures and advice, but no single breakdown across all of Alliance Medinet’s clients has been published.

The timeline is also worth watching. The group says it reported the incident to the regulator on 21 October, Income says it was told on 22 October, and the public filing came on 24 October. The group’s promised fuller update, and any findings from the forensic investigation, should show when the access began and whether more members are affected.

TSN tracks incidents like this on its ransomware and cyber attacks hub. Recent healthcare cases include Quest Diagnostics, which said an unauthorised party accessed patient records, and Fisher & Paykel Healthcare, which said two staff email accounts and some files were accessed.