CHAPTER 2 TARGET.SG Even as we do our best to secure our systems, it is a matter of when, not if, our systems are breached. The cyber-attack on SingHealth is a reminder for us to do better in our cybersecurity efforts, together as a nation. TARGET.GOV.SG – Mr David Koh, Commissioner of Cybersecurity and Chief Executive CSA, emphasising the need for collective cybersecurity CASE STUDY CYBER-ATTACK ON SINGHEALTH In 2018, SingHealth’s network was the target of a deliberate and well-planned cyber-attack. The scale of this cyber-attack was unprecedented. The personal particulars of 1.5 million patients and the outpatient dispensed medication records of 160,000 of them were illegally accessed and copied. Prime Minister Lee Hsien Loong’s records were specifically and repeatedly targeted. There was, however, no evidence that the data had been tampered with or deleted. No clinical services were disrupted, and patient care remained uncompromised. The Committee of Inquiry (COI) into the cyber-attack on SingHealth’s database system established that the cyberattack was the work of a skilled and sophisticated actor, which bore the characteristics of an Advanced Persistent Threat (APT) group. The COI found that the attacker was wellresourced, and had used advanced techniques and tools to target the SingHealth patient database and illegally exfiltrate patient data. The attacker was persistent, evaded detection for a long time, and even re-entered the network after being detected. 22 WHAT HAPPENED? The attacker gained initial access to SingHealth’s IT network around August 2017, by infecting front end workstations, most likely through phishing attacks. After lying dormant for several months, the attacker moved laterally through the network between December 2017 and June 2018, compromising additional endpoints, servers and user accounts. From May 2018, the attacker made multiple unsuccessful attempts to connect to SingHealth’s patient database system. On 26 June 2018, the attacker obtained credentials to the database, and began querying and exfiltrating patient records the following day. On 4 July 2018, an IT administrator at Integrated Health Information Systems (IHiS), the IT agency serving the public healthcare sector including SingHealth, noticed suspicious queries made on the database. The suspicious queries were terminated by IHiS’s IT administrators, and measures were put in place to prevent further queries from being made. On 10 July 2018, the cyber incident was escalated to the Cyber Security Agency of Singapore (CSA), SingHealth’s senior management, the Ministry of Health (MOH), and Ministry of Health Holdings (MOHH). CSA’s National Cyber Incident Response Team (NCIRT) was immediately deployed on site to work with IHiS to carry out joint investigations and remediation. They took steps to contain the threat, eliminate the attacker’s footholds, and prevent recurrence of the attack. 23