Singapore’s worst cyberattack in its history, in which personal information of about 1.5 million people including the Prime Minister was stolen, has the hallmarks of a state-linked group, the government’s communications minister said on Monday.
In late June, hackers started stealing personal details and prescription records of patients who visited Singapore’s outpatient clinics over the previous three years, authorities announced on July 20.
Speaking in parliament on Monday, S. Iswaran said the government would not disclose the attackers’ identity for security reasons but had determined the attack was the work of an ‘Advanced Persistent Threat’ group which is typically state-linked.
“This (APT) refers to a class of sophisticated cyber attackers, typically state-linked, who conduct extended, carefully planned cyber campaigns, to steal information or disrupt operations,” said Iswaran, Singapore’s minister for communications and information.
Iswaran said government agencies had a high level of confidence in the identity of the attackers but not enough evidence to take legal action.
Health Minister Gan Kim Yong added that the attackers had made efforts to remove their tracks, making investigations harder and that they could strike again.
“Despite our security measures, the attackers had been very patient, very persistent and very resourceful,” said Gan.
“With advanced hacking tools, they eventually succeeded... We take this seriously as there’s no reason to believe that they will not try again with even more advanced tools.”
In the wake of the attack, the government disconnected computers from the internet at public healthcare centres and set up a four-member panel to investigate the incident which will report by the end of December.
Professional services firm PricewaterhouseCoopers (PWC) and the Cyber Security Agency of Singapore are working with the health ministry to identify vulnerabilities in their systems and plug any holes to try and prevent a repeat, Gan added.
Major cyber attacks are rare in Singapore, which has invested heavily in cybersecurity over the past decade. The attack comes as the highly wired and digitalised state has made cybersecurity a priority both at home and for its neighbours in the ASEAN regional bloc.
