SINGAPORE — Singapore’s healthcare sector is facing renewed cybersecurity concerns after the Agency for Integrated Care (AIC) disclosed that personal information belonging to as many as 4,064 employees of public healthcare institutions and community care providers may have been accessed by an unauthorised third party.
The cybersecurity incident, detected on November 10, 2026, involved AIC’s Advance Care Planning (ACP) information technology system, a platform used by trained facilitators to help members of the public document their preferences for future medical treatment and care.
The potentially exposed information includes names, contact numbers, email addresses and National Registration Identity Card (NRIC) numbers.
Although AIC has not confirmed that all 4,064 individuals had their information accessed, the possibility of identity-related data being exposed has raised concerns about privacy protection across Singapore’s increasingly digital healthcare industry.
The incident is particularly significant because it comes amid several other cybersecurity disclosures involving healthcare-related organisations in Singapore over recent weeks.
However, authorities have stressed that there is currently no evidence that patient medical records were accessed or that patient care operations were disrupted.
AIC Detects Unauthorised Access to Advance Care Planning System
AIC confirmed that it discovered the cybersecurity incident on November 10.
The affected platform is its Advance Care Planning IT system, which supports facilitators working with individuals who want to record their preferences for future healthcare decisions.
Advance Care Planning allows people to communicate their values, treatment preferences and wishes concerning future care, particularly in situations where they may eventually become unable to make medical decisions independently.
The system supports facilitators from public healthcare institutions and community care organisations.
According to AIC, information that may have been accessed includes:
- Full names
- Contact numbers
- Email addresses
- NRIC numbers
The agency has not publicly confirmed how the unauthorised party gained access, whether information was downloaded or copied, or whether the exposed details have been circulated elsewhere.
These distinctions remain important because unauthorised access does not automatically establish that every potentially accessible record was stolen or misused.
Investigations are continuing to establish the full extent of the incident.
Up to 4,064 Healthcare and Community Care Employees Potentially Affected
The number of potentially affected individuals has drawn particular attention.
AIC said the incident could involve personal information belonging to up to 4,064 employees working in public healthcare institutions and community care providers.
Its Advance Care Planning partners include major healthcare organisations such as SingHealth, NHG Health and the National University Health System (NUHS).
Community care partners include Fei Yue Community Services, SATA CommHealth, Society of Sheng Hong Welfare Services, Montfort Care, Home Nursing Foundation, Sunlove Abode for Intellectually Infirmed and Lions Befrienders Services Association.
The incident highlights how a cybersecurity vulnerability involving one specialised platform can potentially affect individuals connected to multiple healthcare and community care organisations.
However, there is currently no confirmation that the internal systems of all these partner organisations were compromised.
The reported incident specifically involved AIC’s ACP IT system.
AIC Takes System Offline and Files Police Report
Following the discovery, AIC immediately took the affected system offline as a precaution while investigations were conducted.
The agency also lodged a police report on November 10 and notified Singapore’s Cyber Security Agency (CSA).
While the system was unavailable, Advance Care Planning facilitators continued documenting individuals’ care preferences using physical forms.
AIC subsequently restored access to the system on November 12.
The agency said it would continue investigating the incident, conduct a thorough review of its systems and work with CSA to implement immediate measures to strengthen its cybersecurity defences.
AIC also committed to contacting all potentially affected individuals within three days of its announcement.
Those who believe they may be affected can contact AIC through its official hotline at 1800-650-6060 or email enquiries@aic.sg.
AIC Warns Employees About Phishing, Suspicious Messages and Identity Scams
One of the immediate concerns following the incident is the potential misuse of exposed personal information.
Names, mobile numbers, email addresses and NRIC numbers can provide criminals with information that may help them create more convincing fraudulent communications.
For example, scammers could potentially impersonate healthcare institutions, government agencies or service providers when contacting individuals.
However, there is no confirmed evidence that the exposed information has already been used for fraudulent activities.
AIC has advised potentially affected individuals to remain vigilant when receiving unexpected emails, text messages and telephone calls.
The agency also reminded people not to disclose personal information, passwords or one-time passwords unless they can independently verify the identity of the person requesting them.
This warning is particularly important because legitimate-looking messages may use familiar names, institutions and personal details to convince recipients that a communication is genuine.
Singapore’s Ministry of Health Confirms Six Healthcare-Related Entities Hit by Cybersecurity Incidents
The AIC incident is part of a wider cybersecurity concern involving Singapore’s healthcare sector.
In a November 12 statement, the Ministry of Health (MOH) disclosed that several recent cybersecurity incidents had involved unauthorised access to systems belonging to healthcare and healthcare-related organisations.
These include:
- Agency for Integrated Care (AIC)
- Alliance Medinet
- Doctor Anywhere Group
- Fullerton Health Group
- Minmed Group
- Dementia Singapore’s CARA mobile application
MOH said it was taking the incidents very seriously and was following up with the affected organisations to assess their full implications.
Importantly, the ministry stated that the reported breaches had not disrupted patient care operations.
It also said there was no evidence at that point that patient safety and care had been compromised and that, to its knowledge, patient health records had not been accessed without authorisation in these incidents.
The ministry has instructed Synapxe and public healthcare institutions to increase monitoring for potential cyber threats across public healthcare IT systems.
Private healthcare providers have also been urged to review and strengthen their cybersecurity measures.
The growing number of incidents has raised questions about how healthcare organisations protect personal information across interconnected digital platforms and third-party service providers. Ministry of Health+2
Alliance Medinet Breach Previously Exposed Information Linked to 110,000 Members
One of the most significant earlier incidents involved Alliance Medinet, a healthcare administration provider whose cybersecurity breach affected approximately 110,000 members.
The October 24 disclosure involved unauthorised access to its membership database.
The potentially compromised information included names, identification numbers and contact details.
The incident also raised additional concerns because bank account information belonging to seven members and a medical diagnosis belonging to one member may have been affected.
Customers connected to insurers including HSBC Life, Singlife and Income Insurance were among those potentially affected.
The incident demonstrated how sensitive information can be exposed through third-party healthcare administrators, even when the systems of the insurers themselves have not been compromised.
WWC ONE MEDIA previously examined the incident in its report:
The Alliance Medinet breach and the AIC incident are separate cases. There is no established evidence that they are connected.
Doctor Anywhere and Fullerton Health Also Report Cybersecurity Incidents
Doctor Anywhere disclosed a separate malicious cybersecurity incident in November after an unauthorised third party accessed its systems and personal information belonging to some users was leaked.
The company said its clinical records were not affected and that it had engaged cybersecurity specialists to investigate and strengthen its systems.
WWC ONE MEDIA previously reported on the Doctor Anywhere incident and the separate M1 customer-data breach, which raised concerns about the possible misuse of identification and financial information.
Fullerton Health also reported unauthorised access involving a server supporting its Migrant Worker Primary Care Plan.
The potentially affected information included migrant workers’ names, Foreign Identification Numbers, dates of birth, mobile numbers, email addresses and residential addresses.
The provider said health, medical and financial information was not affected.
These separate disclosures underline the importance of protecting not only clinical databases but also administrative systems that process personal information.
Minmed and Dementia Singapore Add to Healthcare Cybersecurity Concerns
The series of incidents continued with disclosures involving Minmed Group and Dementia Singapore.
Minmed confirmed that a malicious cybersecurity incident affected a standalone system supporting its teleconsultation and health-screening services.
The provider said clinical records were not affected and that its healthcare services and clinics remained operational.
Dementia Singapore also disclosed a cybersecurity incident involving its CARA SG mobile application.
Some members’ personal information, including names, email addresses, telephone numbers and membership identification numbers, may have been compromised.
The incidents are separate, and authorities have not established that they share the same attacker or method of intrusion.
WWC ONE MEDIA has also examined the Minmed incident and the wider implications for Singapore’s healthcare providers:
Singapore Healthcare Provider Minmed Hit by Cyberattack as Two Other Medical Firms Face Breaches.
Together, these cases have intensified scrutiny of cybersecurity safeguards across organisations that handle sensitive healthcare and personal information. CNA+2
MOH Warns That Artificial Intelligence Could Make Cyberattacks More Dangerous
Beyond the immediate breaches, MOH has highlighted the growing cybersecurity challenges facing healthcare institutions as technology advances.
The ministry warned that artificial intelligence could make vulnerabilities easier to identify and cyberattacks more frequent, rapid and formidable.
This presents an additional challenge for healthcare organisations that depend on interconnected systems to manage appointments, patient services, administrative operations and sensitive information.
MOH has urged licensed healthcare institutions and healthcare information management system providers to strengthen their cybersecurity posture and protect the security and integrity of their IT assets.
Meanwhile, CSA said it was monitoring the recent healthcare-related incidents and working with MOH and the Personal Data Protection Commission (PDPC).
The regulatory response reflects the importance of identifying the full extent of unauthorised access, preventing further compromise and ensuring that affected individuals receive appropriate information. Ministry of Health+1
What Potentially Affected Individuals Should Do
Although AIC has not confirmed that the information of every potentially affected employee was accessed, individuals should take precautions while investigations continue.
Recommended precautions include:
- Be cautious of unexpected emails, text messages and telephone calls claiming to come from healthcare institutions or government agencies.
- Never disclose passwords, banking credentials or one-time passwords to unsolicited callers.
- Avoid clicking unfamiliar links or downloading unexpected attachments.
- Verify requests for personal information through official organisational contact channels.
- Monitor accounts for suspicious activity and report suspected impersonation attempts.
Individuals who receive an official notification from AIC should follow the instructions provided and contact the agency directly if they have questions.
The most important precaution is to remember that having someone’s name, contact details or NRIC number does not give another person legitimate authority to request passwords or verification codes.
Singapore Healthcare Sector Faces a Growing Test of Public Trust
The AIC cybersecurity incident raises a broader question about the protection of personal information as Singapore continues expanding its digital healthcare infrastructure.
Digital systems have made healthcare administration more accessible and efficient. They allow organisations to coordinate services, maintain documentation and support individuals making important decisions about their future care.
However, the benefits also come with greater responsibility.
A single security weakness in a system handling personal information can create consequences extending beyond the organisation directly affected.
The recent incidents involving AIC, Alliance Medinet, Doctor Anywhere, Fullerton Health, Minmed and Dementia Singapore demonstrate why cybersecurity must remain a priority across the entire healthcare ecosystem.
For AIC, the immediate priorities are completing its investigation, determining the full extent of potential data exposure and ensuring that affected individuals receive timely information.
For Singapore’s healthcare industry, the challenge is broader: maintaining public confidence while ensuring that digital transformation does not create additional vulnerabilities.
The absence of confirmed patient health-record exposure is an important distinction, but it does not eliminate the potential risks associated with compromised identity information.
As investigations continue, the central question remains whether the latest cybersecurity incidents will prompt stronger safeguards across Singapore’s healthcare institutions before another organisation experiences a similar breach.
