SingHealth Breach Caused by Vulnerability in Code; Case Holds Key Lessons for U.S. Entities

By Jane Anderson

A massive data breach in Singapore, which released medical information for around 1.5 million individuals covered by SingHealth, ultimately was caused by inadequate cybersecurity training and was exacerbated by poor management and existing vulnerabilities in the system.

That’s the word from a report released in January dissecting the breach, which holds lessons for HIPAA covered entities and business associates in the United States. “These imperatives apply equally to all organizations responsible for large databases of personal data,” said the 454-page report, issued by the Singapore Committee of Inquiry formed to investigate the breach. “We must recognize that cybersecurity threats are here to stay, and will increase in sophistication, intensity and scale.”

David Harlow, principal in health care law at consulting firm The Harlow Group LLC, says the report echoes the cybersecurity problems faced by U.S. health care entities. “All of the major cases of the past year or so relate to these sorts of issues,” Harlow tells RPP. “These sorts of recommendations need to be taken to heart by health care organizations everywhere.”

Among the key events that led to the breach and potentially made it worse:

  • A now-fired employee discovered a coding vulnerability in Allscripts Healthcare Solutions Inc.’s Sunrise electronic health record (EHR), which was in use at SingHealth, but elected to disclose the vulnerability to Epic Systems Corporation instead. The vulnerability ultimately led to the attack.

  • SingHealth’s information technology administrators noticed suspicious activity over a period of almost a month, but didn’t realize that it might mean a serious cyberattack was underway.

  • Key IT management personnel at SingHealth failed to take action in a timely and effective manner, in part because they were afraid of a false alarm.

The SingHealth cyberattack occurred between Aug. 23, 2017, and July 20, 2018. Personal data from almost 1.5 million SingHealth patients, including names, identification numbers, addresses, genders, races and dates of birth, were exfiltrated between June 27 and July 4, 2018. Around 159,000 of those nearly 1.5 million patients also had their outpatient dispensed medication records stolen. Prime Minister Lee Hsien Loong’s personal and outpatient medication data “was specifically targeted and repeatedly accessed,” according to the report.

This document is only available to subscribers. Please log in or purchase access.
Purchase Login


Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field

First name field cannot be blank!
Last name field cannot be blank!
We will send you an email that will give you access to this entire article.
Email field cannot be blank!
Enter a valid email!
Company field cannot be blank!
Enter a valid company!
Title field cannot be blank!

We're committed to your privacy. The Society of Corporate Compliance and Ethics (SCCE) & Health Care Compliance Association (HCCA) uses the information you provide us to contact you about our relevant content, products, and services. For more information, check out our Privacy Policy.


About SCCE

The Society of Corporate Compliance and Ethics (SCCE) is a non-profit, member-based professional association. SCCE supports our members' work with education, news, and discussion forums. We are a community of leaders, defining and shaping the corporate compliance environment across a wide range of industries and geographic regions. In developing and maintaining effective ethics and compliance programs, our members strengthen and protect their companies.

952.933.4977

About HCCA

The Health Care Compliance Association (HCCA), is a 501(c)6 non-profit, member-based professional association. HCCA was established in 1996 and is headquartered in Minneapolis, MN. We provide training, certification, and other resources to over 10,000 members. Our members include compliance officers and staff from a wide range of organizations, including hospitals, research facilities, clinics and technology service providers.

952.988.0141

Facebook X LinkedIn
Copyright © 2024 by Society of Corporate Compliance and Ethics (SCCE) & Health Care Compliance Association (HCCA). No claim to original US Government works. All rights reserved. All information provided through this site, including without limitation all information such as the “look and feel” of the site, data files, graphics, text, photographs, drawings, logos, images, sounds, music, video or audio files on this site, is owned and/or licensed by SCCE & HCCA or its suppliers and is subject to United States and international copyright, trademark and other intellectual property laws. Any third party logos and/or content provided herein is owned by such third parties and is used by permission herein. Your use of this site to is subject to our Terms Of Use and Privacy Statement.
Cookie settings