Singapore Disconnects Healthcare Computers From the Internet After Cyber-Attack

Singapore has disconnected computers from the Internet at public healthcare centres to prevent cyber-attacks of the kind that caused its worst breach of personal data, a government official said on Tuesday.

Singapore started to cut web access for civil servants in 2016 to guard against cyber-attacks, but stopped short of including public healthcare institutions. Officials may still surf the web using separate personal or agency-issued devices.

In the most recent attack in June, hackers stole particulars of more than 1.5 million patients, including the prime minister's drug prescriptions, in what the government has called "a deliberate, targeted and well-planned cyber-attack".

The government on Monday wrapped up the task of disconnecting staff computers at public healthcare facilities from the Internet, Deputy Prime Minister Teo Chee Hean said.

"We could, and should, have implemented Internet surfing separation on public healthcare systems, just as we have done on our public sector systems," Teo said in a speech at an engineering conference.

"This would have disrupted the cyber kill-chain for the hacker and reduced the surface area exposed to attack. This has now been done."

He did not say why the measure had not been adopted earlier.

The disconnection will cause "some inconvenience for patients and healthcare staff, as a result of the unavailability of some IT system connections that require the Internet," the health ministry said in a statement on Monday.

Government officials did not say who might have been behind the attack, and cyber-security experts said it was too early to identify the infiltrators.

Internet Surfing Separation, or air-gapping, is common in security-related fields in government and business, but not for normal government functions and, according to experts, does not guarantee success.

The idea is that computers used by government staff for their work, which are connected to an internal network, are isolated from the wider Internet, reducing the exposure of official government data to cyber-attacks.

The procedure drew criticism when introduced in the public services two years ago, with cyber-security experts calling it a retreat for a technologically advanced city-state that has adopted the term "smart nation" for its initiatives.

The government has set up a four-member panel headed by a former judge to investigate the cyber-attack which will report by the end of December, it said.

Separately, the Monetary Authority of Singapore has told financial institutions to tighten customer verification measures in the wake of the healthcare attack, it said on Tuesday.