Singapore’s Ministry of Health disclosed that confidential information from its HIV Registry, covering 14,200 people diagnosed with HIV, had been leaked online. The ministry said the data was in the possession of Mikhy Farrera-Brochez, a US citizen whose partner was a Singaporean doctor with access to the registry.
What happened
- The leaked records included names, identification numbers, contact details, and HIV test results for people diagnosed up to January 2013, plus details of 2,400 of their contacts.
- The ministry said it had first learned in 2016 that some registry information was in unauthorised hands, and was criticised for not informing those affected at the time.
- Authorities worked with platform operators to disable access to the leaked information.
- Farrera-Brochez was later prosecuted in the United States in connection with the case.
Why it mattered
The leak exposed some of the most sensitive health data a government holds and prompted questions about insider access controls and the decision to delay notification. It also showed how damaging a leak can be long after data is first taken, with lasting harm for the people named in it.
Lessons for organisations
Restrict access to special category data on a strict need-to-know basis, log and review privileged access, and have a clear breach notification process for affected individuals. Record who holds copies of sensitive datasets and remove access promptly when roles change.
Sources: Singapore Ministry of Health, CNN
Part of our Top stories archive of headline-making events in information security, privacy, and AI. If you would like help applying the lessons to your organisation, contact us.
