CyphrQ
Menu

SingHealth Data Breach 2018: How It Happened and What PDPC Fined

The 2018 SingHealth data breach hit about 1.5 million patients. How attackers got in, the S$1 million PDPC penalties, and lessons for IT teams.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

Incident: June 201810 min read

The SingHealth data breach was a 2018 cyberattack on Singapore's largest public healthcare group. Attackers copied the personal particulars of about 1.5 million patients, and the outpatient medicine records of about 160,000 of them. In January 2019, Singapore's Personal Data Protection Commission (PDPC) fined the IT vendor IHiS S$750,000 and SingHealth S$250,000.

It's one of the best-documented breaches anywhere. A public Committee of Inquiry (COI) report, a regulator's decision and several ministerial statements set out what went wrong in unusual detail. That makes it a useful case for any organisation that runs a large database through an outsourced IT team.

This article covers what happened, whose data was taken, how the attackers got in, the penalties, and what changed. For IT and security teams, there's a technical section on the attack chain, the control failures and what to check in your own estate.

Case file

Field Detail
Organisation Singapore Health Services (SingHealth); IT run by Integrated Health Information Systems (IHiS)
Region Singapore (Asia)
Breach date Data copied 27 June to 4 July 2018 (MCI and MOH)
Disclosed 20 July 2018 (MCI and MOH)
People affected About 1.5 million patients; about 160,000 of them also lost outpatient dispensed medicine records (MCI and MOH)
Data types Name, NRIC number, address, gender, race, date of birth; outpatient dispensed medicines
Penalty S$750,000 on IHiS, S$250,000 on SingHealth: S$1 million in total (Singapore Government)
Regulator Personal Data Protection Commission (PDPC), Singapore
Status Closed: PDPC decision announced January 2019; COI public report released 10 January 2019

What happened in the SingHealth cyberattack, and when?

The attack was announced in a joint press release by Singapore's Ministry of Communications and Information (MCI) and Ministry of Health (MOH) on 20 July 2018. According to that release, the key dates were (MCI and MOH):

  • 27 June to 4 July 2018: patient data was taken from SingHealth's database.
  • 4 July 2018: IHiS database administrators spotted unusual activity and acted to stop it.
  • 10 July 2018: the activity was confirmed as a cyberattack.
  • 12 July 2018: a police report was lodged.
  • 20 July 2018: the public was told.

The government said no records were changed or deleted, and no further data was taken after 4 July (MCI and MOH). The Health Minister later told Parliament that further malicious activity was detected after containment began, but no more patient data was accessed or copied (MOH, 6 August 2018).

The Minister-in-charge of Cybersecurity convened a Committee of Inquiry. It handed its classified report to the government on 31 December 2018 and released a public version on 10 January 2019 (Singapore Government).

Which SingHealth patients' records were taken, and how many?

The people affected were patients who visited SingHealth's specialist outpatient clinics and polyclinics between 1 May 2015 and 4 July 2018 (MCI and MOH).

  • About 1.5 million patients had their personal particulars accessed and copied: name, NRIC number (Singapore's national identity number), address, gender, race and date of birth.
  • About 160,000 of those patients also had their outpatient dispensed medicine information taken.
  • Not taken: phone numbers, passwords and credit card details, according to the Health Minister (MOH, 6 August 2018).

The government also said the Prime Minister's records were "specifically and repeatedly targeted" (Singapore Government).

In practice: notification at this scale is a project in itself. SingHealth contacted more than 2 million patients and reached around 97% of them (MOH, 15 January 2019). SMS notifications went out from 20 to 23 July 2018 (MOH, 6 August 2018).

Why does a list of names and ID numbers matter? A national ID number is hard to change. Once it's copied alongside a name, address and date of birth, it stays useful to fraudsters for years.

How did the attackers get into SingHealth's systems?

The short version, from the government's first statement: the attackers breached "a particular front-end workstation", then obtained privileged account credentials, which gave them privileged access to the database (MCI and MOH).

A front-end workstation is an ordinary user's computer. Privileged credentials are the usernames and passwords of administrator accounts, the ones allowed to manage servers and databases.

The Health Minister's statement to Parliament on the COI report summarised what the inquiry found (MOH, 15 January 2019):

  • People: IHiS staff "did not have sufficient levels of cybersecurity awareness, training and resources to respond to the attack."
  • Technology: the attacker exploited "servers that were not adequately secured against unauthorised access" and "weak passwords and administrator account controls."
  • Process: there were weaknesses in asset management and policy compliance, and "inadequate remediation of known system vulnerabilities."

The government's response added three points from the COI (Singapore Government):

  • The attacker was a skilled group with the characteristics of an advanced persistent threat (APT): a well-resourced attacker who stays hidden in a network for a long time.
  • The attacker "was persistent, evaded detection for a long time, and even re-entered the network after being detected."
  • "The success of the attacker in obtaining and exfiltrating the data was not inevitable."

That last line is the one to remember. The COI didn't treat this as an unstoppable attack. It found gaps that could have been closed.

The full public COI report sets out the attack path step by step, including dates of first entry and the servers involved (COI public report). We have kept to the details confirmed in the government's statements above.

What penalties did the PDPC impose on SingHealth and IHiS?

The PDPC imposed financial penalties of S$750,000 on IHiS and S$250,000 on SingHealth, S$1 million in total (Singapore Government; PDPC decision). The Health Minister told Parliament: "This is the highest penalty meted out by the PDPC to date" (MOH, 15 January 2019).

The split matters. IHiS ran the systems, so it carried the larger penalty. SingHealth owned the patient database, and it was penalised too. Outsourcing the IT didn't outsource the responsibility for the data.

There were also consequences for individuals. IHiS ended the employment of its Citrix Team Lead and its Security Incident Response Manager, fined two middle managers, demoted the Cluster Information Security Officer, and fined its CEO and four other senior managers. SingHealth's senior leadership, including the Group CEO, volunteered for a financial penalty (MOH, 15 January 2019).

What did the Committee of Inquiry recommend?

The COI made 16 recommendations: 7 priority recommendations to be implemented immediately and 9 additional recommendations to be seriously considered. They fall into four groups: people, process, technology and partnerships. The government accepted all of the COI's findings and recommendations (Singapore Government).

The COI also found that SingHealth had no management line of sight over cybersecurity risk and relied wholly on IHiS (Singapore Government). For any board that outsources IT, that finding is the uncomfortable mirror.

What changed after the SingHealth breach?

Internet surfing separation. Staff computers in public healthcare were cut off from the open internet. SingHealth started on 19 July 2018, and the NUHS and NHG clusters on 23 July (MOH, 6 August 2018). The Health Minister later said this temporary separation "has indeed posed challenges in the provision of patient care", and a virtual browser pilot was planned at NUHS as an alternative (MOH, 15 January 2019).

New technical controls at IHiS (MOH, 15 January 2019):

  • Database Activity Monitoring on the SingHealth electronic medical records database, to be extended to other clusters by mid-2019.
  • Two-factor authentication for administrative access to domain controllers.
  • Faster deployment of advanced threat protection on endpoints, plus tighter firewall rules.
  • "Cyber Range" simulation training for staff.

New governance. The MOH Chief Information Security Officer role was separated from IHiS's cyber governance role, and a "three lines of defence" model was set up, including a Cyber Defence Group in IHiS (MOH, 15 January 2019).

Wider government action (Singapore Government):

  • The Cyber Security Agency (CSA) told all critical information infrastructure sectors to strengthen network security, including removing non-essential connections to unsecured external networks.
  • The rollout of new government IT systems was paused from 20 July to 3 August 2018 to check for breaches and add monitoring to critical databases.
  • A Government Bug Bounty Programme was launched covering five internet-facing systems.
  • Singapore's Cybersecurity Act came into force on 31 August 2018.

Going deeper: for security and IT teams

Attack chain mapped to MITRE ATT&CK. Only the stages confirmed in the government statements are mapped here. The mapping is ours, not the COI's.

Stage (as officially described) ATT&CK technique Where to look
Initial breach of a user workstation T1566 Phishing is the common route; the statements quoted here don't name the method Mail gateway verdicts, EDR process trees from Office apps and browsers
Privileged credentials obtained and used T1078 Valid Accounts; credential theft often via T1003 OS Credential Dumping Admin logons from user subnets, LSASS access alerts
Movement towards the database tier T1021 Remote Services Remote-access and jump-server logs, east-west flows
Bulk queries on the patient database T1213 Data from Information Repositories is the closest fit Database audit logs, query volume per account
Traces removed during the operation T1070 Indicator Removal Gaps in event logs, cleared logs, deleted tooling

Control failures the COI identified (as summarised to Parliament): servers not adequately secured against unauthorised access; weak passwords and administrator account controls; weak asset management and policy compliance; known vulnerabilities not remediated; and incident response staff without the awareness, training or resources to act (MOH, 15 January 2019). The threat model is a patient, well-resourced attacker who wants a specific high-value record set and will come back after eviction.

Privileged-access lessons. The path ran from one user workstation to database administrator rights. Break that path:

  • Separate administrator accounts from daily-use accounts, and never let admin credentials be typed on user workstations.
  • Require phishing-resistant multi-factor authentication for every privileged logon, not only for domain controllers.
  • Route admin access through hardened jump hosts or privileged access workstations, with session recording.
  • Enforce password length and rotation on service and admin accounts, and remove standing admin rights where just-in-time elevation will do.

Database-monitoring lessons. The data was taken over about a week, from 27 June to 4 July 2018 (MCI and MOH). That's a window a database activity monitoring tool is built to catch. IHiS added exactly this control afterwards.

  • Baseline normal query volume and row counts per account, and alert on large result sets.
  • Alert on queries against VIP or sensitive records, and on interactive queries from accounts that normally run only from applications.
  • Ship database audit logs off the server, so an attacker with admin rights can't quietly erase them.

Detection signals to alert on.

  • Privileged account logons from a workstation subnet, or outside change windows.
  • A user workstation opening sessions to database or remote-access servers it has never touched.
  • Large outbound transfers from servers that rarely send data out.
  • Security event logs cleared, or a host that stops sending logs.
  • Suspicious activity reported by staff that isn't escalated within hours. The COI found failures in incident response roles, so test the escalation path, not just the tooling.

What to check in your own estate.

  1. Can you list every path from a user workstation to your most sensitive database? Prove each one is blocked or monitored.
  2. Are there legacy servers that should have been decommissioned but still hold network connections to production data?
  3. When were known vulnerabilities on servers next to the database last remediated, and who signs off exceptions?
  4. Does a database query returning 100,000 rows raise an alert anyone reads?
  5. If you outsource IT, does your board get its own view of cyber risk, or only the vendor's?

Key takeaways

  • The SingHealth data breach exposed about 1.5 million patients' personal particulars, and about 160,000 patients' outpatient medicine records, between 27 June and 4 July 2018.
  • The path ran from one front-end workstation to privileged database access, through weak admin controls and unpatched, under-secured servers.
  • The PDPC fined IHiS S$750,000 and SingHealth S$250,000: S$1 million, the highest PDPC penalty at the time.
  • Outsourcing IT didn't move the data owner's responsibility. Both the vendor and the owner were penalised.
  • The COI said the theft "was not inevitable". Privileged-access control and database monitoring are the two places to start.

Sources