Posted on August 30, 2021 at 4:49 PM
73,000 Patients Impacted In A Massive Cyberattack On Singapore Eye Clinic
According to a recent report, a private clinic in Singapore has become a victim of a ransomware attack. The clinic, Eye & Retina Surgeons (ERS), stated that the incident affected its server and management systems, which manage more than 73,000 patients.
The report noted that the threat actors exposed the names of the patients, their contact details, identity card numbers, addresses, and clinical information. However, the clinic said no bank account or credit card details were compromised.
Also, clinical operations and active medical records, stored in a distinct cloud-based system, were not impacted.
All The Systems Have Been Restored
The report also stated that the ERS did not pay any ransom to the attackers, who are yet to be identified. Singapore’s Ministry of Health (MOH) noted that it has been working closely with the Cybersecurity Agency of Singapore and the ERS to identify the main causes of the incident.
The clinic said it has restored the systems and the IT experts have carried out comprehensive checks on the systems. They have also reformatted the servers and scanned them with antivirus to make sure they are properly secured.
The ERS also stated that no data leak has been reported yet, but it is still very active and alert.
It also noted that measures have been taken to make sure that such incidents don’t occur again. It has started the process of informing its patients about the attack to enable them to stay alert pending any new development.
The Ministry of Health also said none of the agency’s IT systems were linked to the compromised IT systems of the clinic.
Increased Level Of Cyberattacks In Singapore
In the past, cyberattacks were prevalent in the finance sector. Although the bulk of the ransomware attacks are still in this sector, the level of attacks on health sectors has surged heavily.
Singaporean organizations have experienced a fair share of ransomware attacks in the past few weeks.
After the attack on ERS, tech firm Pine Labs and Tokio Marine Insurance became the next victims of ransomware attacks.
The Cyber Security Agency of Singapore (CSA) in its recent report, stated that 89 cases of ransomware attacks on organizations were reported last year. This is a 153% increase in the number of attacks witnesses in 2019.
The attacks, according to the reports, were executed on small and medium organizations, including healthcare, retail, and manufacturing sectors.
Earlier this month, the Ministry of Health issued Healthcare Cybersecurity Essentials guidelines, reminding all licensed healthcare providers to beef up their security against attacks. The agency asked the providers to always review their security network and enforce new measures to adopt best practices and provide better security for their IT systems and endpoints.
As threat actors keep looking for vulnerabilities in healthcare systems, they sometimes become successful as a result of a lack of solid security systems by the victims. And healthcare data usually gets high value on the web, making them even more attractive to more threat actors.
An EY report recently placed a value on healthcare data in the UK, placing it at several billion pounds. Another report from Mckinsey showed that the value of digital health in Asia could hit $100 billion by 2025.
The high value placed on healthcare data has led to an increased interest from bad actors who often have a busy darknet market they can sell their loot.
Organizations Asked To Improve Their Security
This will be the second time a major healthcare organization will be targeted in the country. In 2018, the systems of SingHealth were hit with ransomware, affecting more than 1.5 million patients. The data breach incident was dubbed one of the worst cyberattacks in the country’s history. It also affected popular figures, including Prime Minister Lee Hsein Loong.
Security experts have always stressed the need for organizations to protect their systems by investing in top-level security tools. They are also advised to make cyber security awareness one of the top education priorities for their employees.
