The confidential information of 14,200 individuals diagnosed with the human immunodeficiency virus (HIV) and over 2,000 others have been leaked online.
The records were illegally obtained back in 2016 by the ang moh ex-boyfriend of the former head of the National Public Health Unit in the Ministry of Health.
MOH was informed by police about the leak on Tuesday (22 Jan), and disclosed the matter to the public today (28 Jan).
The records, which include names, identification numbers, phone numbers and addresses, are those of:
-5,400 Singaporeans and Permanent Residents diagnosed with HIV up to January 2013. Of these, 3,500 are still living.
-8,800 foreigners diagnosed with HIV up to December 2011.
-2,400 individuals identified through contact tracing up to May 2007.
The leaked records of the HIV-positive individuals also included their HIV test results and related medical information.
Said Health Minister Gan Kim Yong at today’s press conference:
“I’m sorry that one of our former staff who was authorised to have access to confidential information in our HIV registry appears to not have complied with our security guidelines.”
He added:
“Going forward, we will continue to strengthen and review our systems to ensure they’re secure, and our priority remains on the patients’ wellbeing and to extend whatever assistance and support we can.”
Timeline of Events Leading Up to the Data Breach
The criminal duo responsible for the data breach are Dr Ler Teck Siang and his American ex-boyfriend Mikhy K Farrera Brochez.
Ler submitted his own blood sample in place of Brochez, who is HIV-positive, to deceive the Manpower Ministry so Brochez could acquire an employment pass in 2008.
He pulled the same stunt again to help Brochez, who was at the time already a lecturer at a local polytechnic, to secure another employment pass in 2013.
Ler, who headed the National Public Health Unit from March 2012 to May 2013, had access to the HIV registry which stored the confidential information of HIV patients.
Brochez reportedly managed to get hold of the information illegally.
In May 2016, MOH lodged a police report after receiving information that Brochez was in possession of confidential information that appeared to be from its HIV Registry.
Their properties were searched and all relevant material found were seized and secured by the police.
In June 2016, Brochez was detained by police, and he was jailed for 28 months in March 2017 after being convicted of numerous fraud and drug-related offences.
The fraud offences were in relation to him lying about his HIV status to the MOM in order to obtain and maintain his employment pass, providing false information to police officers during a criminal investigation and using forged degree certificates in job applications.
In 2018, after Brochez had been deported, the Health Ministry received information that Brochez still had part of the records and the information “did not appear to have been disclosed in any public manner”.
Ler, was sentenced to 2 years’ jail in November 2018, after he was found guilty of 2 charges each of abetment of cheating and giving false information to a public servant for helping Brochez forge his blood test results.
He is appealing the conviction and sentence.
Ler was also charged under the Official Secrets Act for failing to take reasonable care of confidential information regarding HIV-positive patients, but that charge was stood down for trial and is pending before the Courts.
On 22 Jan this year, MOH was notified by police that more information from the registry could be in Brochez’s possession and that he had disclosed the information online.
The Health Ministry says that it is working with relevant parties to scan the Internet for signs of further disclosure of the information.
Said the ministry:
“The incident is believed to have arisen from the mishandling of information by Ler, who is suspected of not having complied with the policies and guidelines on the handling of confidential information.”
