Singapore, 21 December 2019 – HMI Institute of Health Sciences (HMI Institute) discovered a file server to be encrypted by ransomware on 4 December 2019. The affected server was immediately taken offline and isolated from the Internet and internal network. The affected server primarily contained backup information, and HMI Institute’s learning management system was not impacted. As such, daily operations of HMI Institute were unaffected and continued as usual.
Upon discovery of the incident, HMI Institute had immediately engaged a cybersecurity firm to conduct investigations. The findings so far show that the incident was a random and opportunistic attack on the file server. Also, based on the investigation findings of the cybersecurity firm, while the information in the affected server was encrypted, there is no evidence that it has been copied or exported, hence there is a low likelihood of a data leak. The affected file server has since been decommissioned from use. HMI Institute’s main student registry remains intact and unaffected.
The data backed up in the affected server totals approximately 120,000 individuals. Types of personal information includes some or all of the students’ and applicants’ data, such as full names, NRIC numbers, dates of birth, home addresses and email addresses, depending on the course enrolled or applied for. Amongst the affected individuals, approximately 98,000 are SAF servicemen who attended the Cardio Pulmonary Resuscitation (CPR) and Automated External Defibrillation (AED) course, whose full names and NRIC numbers were backed up in the affected server.
“We take this incident very seriously and we deeply apologise to the students and applicants affected for the inconvenience caused. Preserving their privacy and keeping their personal data safe are our highest priority. While we have been informing those affected directly, we are making this announcement as a precautionary measure so that all our students and applicants would be aware and more vigilant. We have also put in place additional measures to fortify our systems against increasingly sophisticated cyber intrusions,” said Mr Tee Soo Kong, Executive Director, HMI Institute of Health Sciences.
This incident has been reported to the Personal Data Protection Commission (PDPC) and the Singapore Computer Emergency Response Team (SingCert). HMI Institute is currently completing the implementation of additional IT security enhancement initiatives including the establishment of a secured wide-area network and an enhanced cybersecurity protection suite.
HMI Institute has been actively informing affected students and applicants via multiple communication channels including emails, letters and face-to-face meetings. Students and applicants can email firstname.lastname@example.org or call our dedicated line 6564 6152 should they have further enquiries regarding this incident.
For further information, please contact:
The Hoffman Agency
Tel: +65 6721 9961