Singapore | Hackers who targeted PM won’t be named

Lee Hsien Loong

Singapore officials said yesterday that it isn’t in the country’s interest to nab — or even name — the perpetrator of a cyberattack that breached 1.5 million health records, including those of Prime Minister Lee Hsien Loong.

An inquiry into the July 4 breach, believed to be the largest in Singapore’s history, concluded that it was likely state-linked. The inquiry called for hearings and considered factors like the attacker’s persistence, resources and advanced tactics.

In a public report released last week, it said “the attacker had a clear goal in mind, namely the personal and outpatient medication data of the Prime Minister in the main.” Lee is a two-time cancer survivor.

Minister of Communication and Information S. Iswaran, who is also in charge of cybersecurity, told Parliament yesterday that the attacker could not be named for “national security reasons” and the copied personal data has not “emerged in any form” on the dark web.

The country has strengthened its cybersecurity portfolio since the breach, Iswaran said. It will adopt new systems, such as one that can aggregate, analyze and isolate threats in real time.

Iswaran added that actions have been taken against individuals and organizations that could have “limited or stopped” hackers.

“That is the totality of our response,” he said. “I don’t think we should reduce whether we have confidence in the sense of justice to just one specific point, that there’s no public attribution of the perpetrator.”

Pressed by a member of Parliament, Iswaran said naming the perpetrator was “not in our interest.”

“And it’s not because we lack the legislative capacity to do so, if indeed it is within our jurisdiction,” he added.

Around 1.5 million people who visited outpatient clinics in Singapore from May, 1, 2015, to July 4 last year had their personal data accessed and copied. This included names, identification card numbers, addresses, race, gender and dates of birth. Of that total, 160,000 had their records of dispensed medicines copied too.

Officials have said that patients’ information was not amended or deleted. They also said hackers did not have access to other records, such as diagnosis documents, test results or doctors’ notes.

Lee, who has been prime minister since 2004, has said he didn’t know what the attackers were hoping to find.

He has been treated for intermediate-grade malignant lymphoma and prostate cancer. In 2015, he underwent surgery to remove his prostate gland and was subsequently given the all-clear sign by doctors.

“My medication data is not something I would ordinarily tell people about, but there is nothing alarming in it,” Lee said on Facebook last year after news of the breach broke. AP