The HIV-positive status of 14,200 people and their identification numbers and contact details have been leaked online by an American fraudster, the Ministry of Health (MOH) said on Monday (28 January).
The records belonged to 5,400 Singaporeans diagnosed with HIV up to January 2013 and 8,800 foreigners, including work and visit pass applicants and holders, diagnosed with the disease up to December 2011, MOH said in a press release.
The leaked information included their name, identification number, contact details such as phone number and address, HIV test results and related medical information.
The details of another 2,400 individuals identified through contact tracing up to May 2007 were also leaked, MOH added.
MOH said it is working with the relevant parties to disable access to the information.
“We are sorry for the anxiety and distress caused by this incident. Our priority is the wellbeing of the affected individuals. Since 26 January, we have been progressively contacting the individuals to notify them and render assistance,” MOH said.
On 22 January, MOH was notified by the police that confidential information from MOH’s HIV Registry may have been disclosed by an unauthorised person. MOH made a police report the following day.
MOH ascertained on 24 January that the information matched the HIV Registry’s records up to January 2013. It immediately worked with the relevant parties to disable access to the information.
“While access to the confidential information has been disabled, it is still in the possession of the unauthorised person, and could still be publicly disclosed in the future,” MOH said.
The confidential information was in the illegal possession of Mikhy K Farrera Brochez, a male US citizen who was residing in Singapore, on an employment pass, between January 2008 and June 2016, according to MOH.
Brochez was convicted of numerous fraud and drug-related offences in March 2017, and he was sentenced to 28 months’ jail.
He had lied about his HIV status to the Ministry of Manpower, in order to obtain and maintain his employment pass, furnished false information to police officers during a criminal investigation, and used forged degree certificates in job applications.
Upon completing his jail sentence, Brochez was deported from Singapore and currently remains outside Singapore.
Brochez was a partner of Ler Teck Siang, a male Singaporean doctor, who was the Head of MOH’s National Public Health Unit (NPHU) from March 2012 to May 2013.
Ler had authority to access information in the HIV Registry as required for his work. He resigned in January 2014.
In September 2018, Ler was convicted of abetting Brochez to commit cheating, and also of providing false information to the police and MOH. He was sentenced to two years’ jail. Ler has appealed and his appeal is scheduled to be heard in March 2019.
In addition, Ler has been charged under the Official Secrets Act for failing to take reasonable care of confidential information regarding HIV-positive patients. His case under the OSA is pending.
“This incident is believed to have arisen from the mishandling of information by Ler, who is suspected of not having complied with the policies and guidelines on the handling of confidential information,” MOH revealed.
In May 2016, MOH lodged a police report after receiving information that Brochez was in possession of confidential information that appeared to be from the HIV Registry. Ler’s and Brochez’s properties were searched, and all relevant material found were seized by the police.
After Brochez had been deported from Singapore, MOH received information in May 2018 that Brochez still had part of the records he had in 2016. MOH lodged a police report, and contacted the affected individuals to notify them.
On 22 January 2019, MOH was notified that more information from the HIV Registry could still be in the illegal possession of Brochez. On this occasion, he had disclosed the information online.
Brochez is currently under police investigation for various offences, and the authorities are seeking assistance from their foreign counterparts.
The police have also issued a statement about the leak.
“In response to media queries, the Police confirm that a report was lodged by the Ministry of Health (MOH) on 23 January 2019, regarding a suspected leak of confidential information from MOH’s HIV Registry. We are seeking the assistance of our foreign counterparts in our investigations. It is inappropriate to comment on the case further as investigations are ongoing,” the police said.
Gan Kim Yong’s briefing
Speaking at a briefing on Monday evening that was open to only local media outlets, Health Minister Gan Kim Yong apologised for the data breach.
“I am sorry that one of our former staff who was authorised to have confidential information in our HIV Registry appears to not have complied with our security guidelines and this may have led to an unauthorised person gaining possession of the data and disclosing it online,” Gan said.
MOH takes a serious view of the matter and will continue to monitor the situation, the minister said. It will review its systems to make sure that they are secure, he added.
He also stressed that MOH staff are progressively contacting the affected patients, who can contact counsellors for help.
“I also understand the concerns, anxiety and distress faced by affected patients and our priority is their well-being,” Gan said.