Medical records for 14,200 H.I.V.-positive people in Singapore were obtained by an American and illegally disclosed online, officials said Monday, in the second major data breach of the country’s public health system in less than a year.
“We are sorry for the anxiety and distress caused by this incident,” the Health Ministry said in a statement, adding that it had started to contact affected people on Saturday. “Our priority is the well-being of the affected individuals.”
The Singaporean police notified the Health Ministry on Jan. 22 that confidential information from its H.I.V. Registry “may have been disclosed by an unauthorized person,” the statement said. The ministry said it had filed a police report the next day and spent another two days working “with the relevant parties to disable access to the information.”
Though access was successfully disabled, the information “is still in the possession of the unauthorized person, and could still be publicly disclosed in the future,” the statement said. It named that person as Mikhy K. Farrera Brochez, an American citizen who it said had lived in Singapore on an employment pass from January 2008 to June 2016, when he was jailed. Mr. Brochez could not immediately be reached for comment on Monday.
In March 2017, the ministry said, Mr. Brochez was convicted of “numerous fraud and drug-related offenses” and sentenced to 28 months in prison. The fraud offenses included lying to labor officials about his H.I.V. status, providing false information to the police and using forged degree certificates in job applications.
Mr. Brochez has since been deported, the ministry said, and “remains outside Singapore,” although it did not specify where.
The ministry said the illegally published records included names, identification numbers, contact details, H.I.V. test results and related medical information for 5,400 Singaporeans whose infections were diagnosed as recently as January 2013, and 8,800 foreigners diagnosed up to December 2011. They also included personal information for 2,400 people who had been identified through contact tracing, a procedure for minimizing the spread of a virus.
The disclosure of H.I.V. status is especially sensitive in Singapore, a conservative society where gay sex is banned under a British colonial-era law. According to the Ministry of Health, about 450 new cases of H.I.V. infection are reported in Singapore each year, half of which are transmitted through same-sex intercourse.
The attack is the second major data breach of Singapore’s public health system since July, when a cyberattack compromised data from 1.5 million people, including Prime Minister Lee Hsien Loong, a cancer survivor. Singaporean officials said this month that the perpetrator in that attack “had a clear goal in mind, namely the personal and outpatient medication data of the prime minister.” The government has declined to name the perpetrator, citing national security.
On Monday evening, an official at the Health Ministry referred a reporter to the ministry’s statement on the H.I.V. data breach and declined to comment further.
The Health Ministry said in its statement that “the authorities are seeking assistance from their foreign counterparts.” But it was unclear as of Monday evening whether that included the United States.
Camille Dawson, the counselor for public affairs at the United States Embassy in Singapore, said in an email that the embassy was unable to discuss the specifics of the case because of privacy laws. She added that it also could not comment on continuing investigations.
The Singaporean news media have previously identified Mr. Brochez as a psychologist and former lecturer at Temasek Polytechnic, a university in the city-state. He was reported to have tested positive for H.I.V. shortly after arriving in Singapore, which does not grant employment passes to foreigners with H.I.V., the virus that causes AIDS.
Mr. Brochez’s partner, Ler Teck Siang, is a Singaporean doctor and former head of the ministry’s National Public Health Unit, which gave him access to the H.I.V. Registry. Prosecutors said that Dr. Ler twice submitted his own blood sample when Mr. Brochez was tested for H.I.V. so that Mr. Brochez could remain employed.
Dr. Ler resigned in January 2014 and was sentenced in November to 24 months in prison for abetting cheating and providing false information to the police and the Ministry of Health. He is appealing his conviction.
In addition, Dr. Ler has been charged with “failing to take reasonable care of confidential information regarding H.I.V.-positive patients,” the ministry said.
The Health Ministry said that it had filed an initial police report in May 2016 after learning that Mr. Brochez might have been in possession of confidential information from the H.I.V. Registry. The police searched the properties of Dr. Ler and Mr. Brochez and seized records, and the people affected by the breach were notified.
But in May of last year, after Mr. Brochez had been deported, the ministry learned that he still had part of the data trove and filed a second police report. At the time, the information did not appear to have been disclosed publicly.
(Source: NYT)
“We are sorry for the anxiety and distress caused by this incident,” the Health Ministry said in a statement, adding that it had started to contact affected people on Saturday. “Our priority is the well-being of the affected individuals.”
The Singaporean police notified the Health Ministry on Jan. 22 that confidential information from its H.I.V. Registry “may have been disclosed by an unauthorized person,” the statement said. The ministry said it had filed a police report the next day and spent another two days working “with the relevant parties to disable access to the information.”
Though access was successfully disabled, the information “is still in the possession of the unauthorized person, and could still be publicly disclosed in the future,” the statement said. It named that person as Mikhy K. Farrera Brochez, an American citizen who it said had lived in Singapore on an employment pass from January 2008 to June 2016, when he was jailed. Mr. Brochez could not immediately be reached for comment on Monday.
In March 2017, the ministry said, Mr. Brochez was convicted of “numerous fraud and drug-related offenses” and sentenced to 28 months in prison. The fraud offenses included lying to labor officials about his H.I.V. status, providing false information to the police and using forged degree certificates in job applications.
 |
| The Singaporean police notified the Health Ministry last week that confidential information from its H.I.V. Registry “may have been disclosed by an unauthorized person.”CreditCreditLuis Enrique Ascui/Reuters |
Mr. Brochez has since been deported, the ministry said, and “remains outside Singapore,” although it did not specify where.
The ministry said the illegally published records included names, identification numbers, contact details, H.I.V. test results and related medical information for 5,400 Singaporeans whose infections were diagnosed as recently as January 2013, and 8,800 foreigners diagnosed up to December 2011. They also included personal information for 2,400 people who had been identified through contact tracing, a procedure for minimizing the spread of a virus.
The disclosure of H.I.V. status is especially sensitive in Singapore, a conservative society where gay sex is banned under a British colonial-era law. According to the Ministry of Health, about 450 new cases of H.I.V. infection are reported in Singapore each year, half of which are transmitted through same-sex intercourse.
The attack is the second major data breach of Singapore’s public health system since July, when a cyberattack compromised data from 1.5 million people, including Prime Minister Lee Hsien Loong, a cancer survivor. Singaporean officials said this month that the perpetrator in that attack “had a clear goal in mind, namely the personal and outpatient medication data of the prime minister.” The government has declined to name the perpetrator, citing national security.
On Monday evening, an official at the Health Ministry referred a reporter to the ministry’s statement on the H.I.V. data breach and declined to comment further.
The Health Ministry said in its statement that “the authorities are seeking assistance from their foreign counterparts.” But it was unclear as of Monday evening whether that included the United States.
Camille Dawson, the counselor for public affairs at the United States Embassy in Singapore, said in an email that the embassy was unable to discuss the specifics of the case because of privacy laws. She added that it also could not comment on continuing investigations.
The Singaporean news media have previously identified Mr. Brochez as a psychologist and former lecturer at Temasek Polytechnic, a university in the city-state. He was reported to have tested positive for H.I.V. shortly after arriving in Singapore, which does not grant employment passes to foreigners with H.I.V., the virus that causes AIDS.
Mr. Brochez’s partner, Ler Teck Siang, is a Singaporean doctor and former head of the ministry’s National Public Health Unit, which gave him access to the H.I.V. Registry. Prosecutors said that Dr. Ler twice submitted his own blood sample when Mr. Brochez was tested for H.I.V. so that Mr. Brochez could remain employed.
Dr. Ler resigned in January 2014 and was sentenced in November to 24 months in prison for abetting cheating and providing false information to the police and the Ministry of Health. He is appealing his conviction.
In addition, Dr. Ler has been charged with “failing to take reasonable care of confidential information regarding H.I.V.-positive patients,” the ministry said.
The Health Ministry said that it had filed an initial police report in May 2016 after learning that Mr. Brochez might have been in possession of confidential information from the H.I.V. Registry. The police searched the properties of Dr. Ler and Mr. Brochez and seized records, and the people affected by the breach were notified.
But in May of last year, after Mr. Brochez had been deported, the ministry learned that he still had part of the data trove and filed a second police report. At the time, the information did not appear to have been disclosed publicly.
(Source: NYT)
No comments:
Post a Comment