Fullerton Health server hit by cyberattack; personal data of migrant workers affected

Fullerton Health, a Singapore-based healthcare service provider, experienced a cybersecurity incident that compromised the personal information of migrant workers under its Migrant Worker Primary Care Plan (PCP) programme. The unauthorized access to a server resulted in the exposure of workers' full names, FIN numbers, dates of birth, mobile numbers, email addresses, and residential addresses. The affected data does not encompass health, medical, or personal financial information.

Fullerton Health first learned of the incident on October 31 and immediately activated its incident response protocols. The company has taken precautionary measures to secure its systems while investigations are ongoing. It has notified the Personal Data Protection Commission (PDPC), made a police report, and is collaborating with the Ministry of Manpower (MOM), which oversees the PCP.

The PCP is designed to provide eligible workers in Singapore with affordable healthcare, and participation is mandatory for certain work permit and S Pass holders, including those in construction, marine shipyard, or process sectors. Fullerton Health stated that the incident appears limited to a specific standalone system supporting its PCP programme, and there is no evidence that other programmes, projects, clients, or patients have been impacted thus far.

Fullerton Health assured that all managed care services, healthcare services, and facilities remain operational. The company is currently notifying affected migrant workers, providing them with information regarding the incident, and offering guidance on precautionary steps to protect themselves. Fullerton Health emphasized that protecting personal information is a top priority and expressed regret for any concern or uncertainty caused by this incident, promising to provide updates as more verified information becomes available.