Glossary term
Advanced persistent threat (APT)
An advanced persistent threat (APT) is a skilled, well-resourced adversary that targets an organization over a long period.
Read more
Significant cyber incident
SingHealth patient database attack, 2018
In short
Between August 2017 and July 2018 an attacker broke into the network of SingHealth, Singapore's largest public healthcare group, and copied the records of almost 1.5 million patients, mainly names, ID numbers, addresses and dates of birth. About 160,000 of them also had outpatient medicine records taken. Singapore announced the breach on 20 July 2018. A Committee of Inquiry found weak defenses and slow reporting let the attacker succeed.
What happened
On 4 July 2018 an administrator at the public health IT agency IHiS noticed suspicious queries on the SingHealth patient database and had them stopped. After checks, the Cyber Security Agency of Singapore (CSA) and IHiS confirmed on 10 July 2018 that it was a cyber attack. A joint release by the Ministry of Communications and Information and the Ministry of Health announced it on 20 July 2018.
The data of about 1.5 million patients who visited specialist outpatient clinics and polyclinics between 1 May 2015 and 4 July 2018 was copied. It held name, ID number, address, gender, race and date of birth. The outpatient dispensed medicine records of about 160,000 of those patients were also taken. The ministries said diagnosis, test results and doctors’ notes were not breached and that no records were changed or deleted.
The Committee of Inquiry (COI) found that the attacker had been inside the network since around 23 August 2017 and that its main goal was the Prime Minister’s data. Staff had seen warning signs from 11 June 2018, but the attack was not escalated to IHiS senior management until 9 July 2018.
The COI was convened on 24 July 2018 and its public report came out on 10 January 2019. The Government accepted all of its findings and recommendations on 15 January 2019.
Timeline
-
23 August 2017
Calls from an infected workstation to an overseas command and control server begin; the COI says the attacker gained initial access around this date, most likely by phishing.
-
1 December 2017
A hacking tool and a remote access trojan are installed on a front-end workstation through an unpatched Outlook flaw.
-
December 2017 to June 2018
The attacker moves through the network, takes over many user and administrator accounts and reaches the Citrix servers linked to the patient database.
-
11 June 2018
IHiS administrators first notice unauthorized logins to the Citrix servers and failed attempts to reach the database.
-
26 June 2018
The attacker obtains credentials to the patient database.
-
27 June to 4 July 2018
The attacker queries the database and copies patient records.
-
4 July 2018
An IHiS administrator spots suspicious queries; they are stopped and no further queries succeed.
-
9 July 2018
IHiS senior management are told.
-
10 July 2018
The matter is escalated to CSA, SingHealth, the Ministry of Health and MOHH; joint investigation starts that night.
-
12 July 2018
SingHealth lodges a police report.
-
20 July 2018
The attack is announced; internet surfing separation is put in place for SingHealth.
-
24 July 2018
The Committee of Inquiry is convened.
-
10 January 2019
The public COI report is released.
-
15 January 2019
The Government accepts all findings and recommendations and tells Parliament that the data protection regulator has fined IHiS and SingHealth.
How the attack worked
The main technical account is the public report of the Committee of Inquiry. The Committee found that the attacker showed the characteristics of an Advanced Persistent Threat (APT) group. Its mapping to ATT&CK below is our reading of the behavior the report describes; the report does not use ATT&CK ids.
Getting in
The attacker gained initial access around 23 August 2017 and infected front-end workstations. The COI says it was most likely through phishing, and adds that the evidence for phishing is some, not conclusive. Forensics found calls to an overseas command and control server from that date.
Tools and footholds
On 1 December 2017 a publicly available hacking tool was installed on one workstation by exploiting a flaw in Microsoft Outlook. A patch existed but had not been installed. The tool was used to download malicious files, some disguised as .jpg images, that were really PowerShell scripts (Command and Scripting Interpreter, T1059; Masquerading, T1036). A customized remote access trojan let the attacker run scripts and move files (Ingress Tool Transfer, T1105). A log file from known password-dumping malware held the user’s password in plain text (OS Credential Dumping, T1003).
Moving through the network
From December 2017 to June 2018 the attacker took over many user and administrator accounts, including domain administrator accounts (Valid Accounts, T1078). It reached the Citrix servers that sat between workstations and the patient database. The COI says an open network connection between the Citrix servers and the database was a significant weakness, and that two-factor login was not the only way in for administrators.
Getting the data
The attacker tried and failed to reach the database from May 2018. A coding flaw in the patient record application was likely used to obtain database credentials on 26 June 2018. From 27 June the attacker queried the database and copied records until it was stopped on 4 July 2018. The COI says the malware was custom-made or modified so that antivirus tools did not detect it.
- Get inAround 23 August 2017 a front-end workstation was infected, most likely by phishingTechnique T1566 (MITRE ATT&CK, opens in a new tab)
- Add toolsA hacking tool and a remote access trojan were installed on 1 December 2017Technique T1105 (MITRE ATT&CK, opens in a new tab)
- Take accountsUser and administrator accounts, including domain admins, were compromisedTechnique T1078 (MITRE ATT&CK, opens in a new tab)
- Reach the databaseCitrix servers connected to the patient database were used to reach it
- Copy recordsFrom 27 June to 4 July 2018 the attacker queried the database and copied data
ATT&CK techniques
- Technique Command and Scripting Interpreter Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs. T1059 · Execution
- Technique Ingress Tool Transfer Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into. T1105 · Command and Control
- Technique Masquerading Masquerading is when an attacker changes how a file, program, service or account looks so it seems legitimate. T1036 · Stealth
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
No public attribution to a named group or country.
The Committee of Inquiry found that the attacker was a skilled and sophisticated actor with the characteristics of an Advanced Persistent Threat group (public report, 10 January 2019).
The Minister told Parliament on 15 January 2019 that "we know the identity of the attacker" but would not comment further for national security reasons.
Impact
Almost 1.5 million patients had their personal particulars copied (name, ID number, address, gender, race, date of birth), according to the COI.
About 160,000 of these patients also had outpatient dispensed medicine records taken. The Prime Minister's data was specifically and repeatedly targeted.
The ministries said no other patient records were breached, records were not changed or deleted, healthcare services were not disrupted and patient care was not compromised.
SingHealth intended to contact 2.16 million patients and later reported reaching around 97% of more than 2 million.
The data protection regulator fined IHiS S$750,000 and SingHealth S$250,000, its highest penalties at that time.
Government and regulator response
- 20 July 2018: CSA and IHiS investigated together. Measures included internet surfing separation, extra controls on workstations and servers, account resets and added monitoring. SingHealth began contacting patients by SMS, letters and hotlines.
- 24 July 2018: a Committee of Inquiry was convened. It held 22 days of hearings and heard 37 witnesses over five months.
- 20 July to 3 August 2018: the Government paused the rollout of new government systems while it checked that other systems were not breached.
- 10 January 2019: the public report was released. It made 16 recommendations: 7 priority and 9 additional.
- 15 January 2019: the Government accepted all findings and recommendations. The Health Minister apologized to patients. The data protection regulator fined IHiS S$750,000 and SingHealth S$250,000.
- After the inquiry: CSA told all critical information infrastructure sectors to remove non-essential connections to unsecured external networks and to use data diodes where needed. IHiS added database activity monitoring and two-factor login for administrators of domain controllers. The Government launched a bug bounty program on five internet-facing government systems.
Lessons
-
Do not leave an open path to the crown jewels
The COI found a network connection between the Citrix servers and the patient database that was kept for admin tools and was not needed. Close paths that no one needs.
-
Enforce two-factor login everywhere
Two-factor login for administrators was not the only way to log in, so the attacker used other routes. Make the strong route the only route.
-
Fix what the penetration test finds
A 2017 test found weak admin passwords and segregation gaps. The COI says the fix was mismanaged and incomplete.
-
Train the people who see the first signs
IT staff noticed odd logins and queries from 11 June 2018 but could not read them as an advanced attack. Teach staff what an intrusion looks like.
-
Make reporting easy and safe
The incident response manager delayed reporting because of pressure on his team. Clear rules on when to escalate, and no blame for false alarms, bring leaders in sooner.
-
Owners cannot hand off risk
The Government said SingHealth was ultimately responsible but depended wholly on IHiS. Keep a line of sight over outsourced security.
What to check in your own organization
-
Database paths
List every system that can reach your most sensitive database. Remove those that exist only for convenience.
-
Admin login
Confirm that every administrator login on servers and remote access servers needs a second factor, with no side doors.
-
Patching of user software
Check that mail clients and office tools on workstations are patched, since the first tool arrived through an unpatched Outlook flaw.
-
Open findings
Review the last penetration test. Show who owns each finding and when it was closed.
-
Detection
Test whether you would see unusual logins to remote access servers and bulk queries on a patient or customer database.
-
Escalation
Write down who must be told, and by when, when staff see a possible advanced attack, and practise it.
-
Outsourced IT
Ask your IT provider how it reports security signals to you and how fast.
Where it happened
- Industry Healthcare and pharma Ransomware, stolen staff logins, patient data on leak sites and supplier exposure at hospitals and drug makers, and the rules that apply.
- Country Singapore Singapore faces state-linked espionage against its critical infrastructure, ransomware against businesses and a large volume of botnet infections. Asia Pacific
Questions
What was taken in the SingHealth attack?
Personal particulars of almost 1.5 million patients (name, ID number, address, gender, race and date of birth). About 160,000 of them also had outpatient dispensed medicine records taken, per the COI and the joint ministry release.
Were medical diagnoses or test results stolen?
The ministries said no other patient records, such as diagnosis, test results or doctors' notes, were breached.
Who was behind it?
No group or country has been named. The Government said it knows the identity of the attacker but would not say.
Why was the Prime Minister's data targeted?
The COI says the attacker's main goal was the Prime Minister's personal and outpatient medication data, and also that of other patients. It does not state why.
What did the inquiry conclude?
It said IHiS staff lacked training and resources, key staff did not act in time, the network had weaknesses that could have been fixed, and the attacker was an APT-style actor, but success was not inevitable.
What penalties were imposed?
The data protection regulator fined IHiS S$750,000 and SingHealth S$250,000, the highest it had imposed at that time, as the Government told Parliament on 15 January 2019.
Sources
- Report of the Committee of Inquiry into the Cyber Attack on Singapore Health Services Private Limited Patient Database (public version) Committee of Inquiry, Singapore
- Public Report of the COI into the cyber attack on Singapore Health Patient Database Ministry of Digital Development and Information
- SingHealth's IT System Target of Cyberattack (joint release, 20 July 2018) Ministry of Communications and Information and Ministry of Health
- Government's response to the report of the COI into the cyber attack on SingHealth (15 January 2019) Ministry of Digital Development and Information
- Ministerial Statement on the Committee of Inquiry into the Cyber-Attack on SingHealth's IT System (15 January 2019) Ministry of Health
- Opening Speech at CSA's 10th Anniversary Dinner (18 July 2025) Cyber Security Agency of Singapore
- Opening Speech at the Operation CYBER GUARDIAN Engagement Event (9 February 2026) Cyber Security Agency of Singapore
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.