Data Breach Affects Customers of Six Insurers in Singapore

Insurance News Desk: A cyberattack on a healthcare services company in Singapore has compromised the personal data of about 110,000 members, including customers of six insurance companies.

Alliance Medinet’s membership database was accessed without permission, its parent company, Alliance Healthcare Group, said in a stock exchange announcement on 24 October. The insurers said there was no evidence that their own computer systems had been breached.

The insurers whose customers were affected or potentially affected are HSBC Life, Income Insurance, Singlife, Great Eastern, Cigna and Tokio Marine.

HSBC Life said 3,995 people were affected, including individual policyholders and people covered through their employers. Tokio Marine said data belonging to 6,103 members may have been compromised. Singlife reported 323 potentially affected customers, while Income Insurance said about 70 people were affected. Great Eastern and Cigna have not published total figures.

Alliance Medinet helps companies manage healthcare services and handles medical insurance claims. These are requests for insurers to cover medical costs. To provide these services, it holds members’ personal information.

The data that may have been exposed includes names, identification numbers, phone numbers, dates of birth and insurance policy details.

Alliance Healthcare Group said the bank account information of seven members and one member’s medical diagnosis may also have been compromised. Great Eastern said three of its members’ bank details may be at risk, while Cigna reported that one member’s health information was affected.

The company has not said how the attackers gained access or whether any data was copied or published.

The insurers said customers could continue using their insurance benefits and submitting claims as usual. They are contacting those affected and warning them to be cautious about suspicious calls, messages or emails asking for personal or banking details.

Alliance Healthcare Group said it had hired independent cybersecurity experts to investigate. It has also introduced round-the-clock monitoring of its computer network and the dark web to look for possible information leaks.

The incident was reported to Singapore’s Personal Data Protection Commission on 21 October. The commission is investigating, while the Cyber Security Agency of Singapore is monitoring developments.