Singapore minister: Major cyberattack may be state-linked

A cyberattack that breached 1.5 million health records in Singapore has been attributed to sophisticated cyber attackers who may be state-linked, a Cabinet minister said today.

S. Iswaran, the minister for communications and information, said in Parliament that the government's detailed analysis of last month's cyberattack on SingHealth records found it was the work of an "advanced persistent threat" group.

Such groups comprise sophisticated cyber attackers and are typically state-linked "who conduct extended, carefully planned cyber campaigns, to steal information or disrupt operations," said Iswaran.

The attackers used tools that were advanced and sophisticated, "including customized malware that was able to evade SingHealth's anti-virus software and security tools," he said.

Citing national security reasons, Iswaran said he would not reveal which state was thought to be behind the attack.

Iswaran said other recent cyberattacks by such advanced persistent threat groups include the 2016 hacking of the U.S. Democratic National Committee, thought to be the work of Russia, and the 2014 theft of more than 20 million personnel records from the United States Office of Personnel Management, blamed on China.

The SingHealth cyberattack occurred from June 27 to July 4, and specifically and repeatedly targeted the health records of Singapore Prime Minister Lee Hsien Loong. In the process, the personal particulars of 1.5 patients including the outpatient dispensed medical records of 160,000 were accessed and copied.

Patients' information was not amended or deleted and the hackers did not have access to other records, such as diagnosis documents, test results or doctors' notes.

Iswaran said it was Singapore's most serious breach of personal data. While the country will "do our utmost to strengthen our cybersecurity," he cautioned that it was impossible to completely eliminate the risk of another such attack.

"Ensuring cybersecurity is a ceaseless battle, like our battle against terrorism. It involves changing technology and sophisticated perpetrators who are constantly developing new techniques and probing for fresh weaknesses," he said.

Singapore's government had made the attack public on July 20, and four days later convened a Committee of Inquiry to look into its events and make recommendations by December 31.