A Singapore healthcare group has told shareholders that a subsidiary’s membership database was opened by an outsider. Alliance Medinet, which administers medical benefits for corporate and insurer-backed plans, said roughly 110,000 members had names, identification numbers and contact details exposed. A small subset may also have had bank account numbers taken, and one member’s medical diagnosis was in the exposed data.
Alliance Medinet is a unit of Alliance Healthcare Group, a Singapore-listed provider with a market value near S$38M. The parent said its other businesses were not touched, and that the board has asked shareholders to trade its securities cautiously while the review continues.
The company has brought in independent forensic and cybersecurity specialists, switched on round-the-clock network and dark web monitoring, and reported the incident to Singapore’s Personal Data Protection Commission. Notifications are going out through Medinet, its plan partners and the employers it serves.
The detail that matters most for healthcare administrators is the diagnosis. Member databases are usually built for billing and eligibility, not clinical content, so a single stray diagnosis field means the schema mixed claims data with care data somewhere upstream.
For U.S. compliance teams the parallel is vendor-scoped PHI: a benefits administrator holds the records, but the notification duty and the reputational cost land on the plan sponsors and providers it serves.
