Singapore HIV registry data leaked online in health breach

Singapore issued a photo of US national Mikhy Farrera-Brochez, who they believe is behind the leak

28 January 2019

Confidential data about more than 14,000 people diagnosed with HIV, including foreign visitors, has been stolen in Singapore and leaked online.

Authorities revealed details about the 2016 health data breach on Monday.

They believe an HIV-positive American whose partner was a senior Singaporean doctor is behind the leak.

The hack comes just months after the records of 1.5m Singaporeans, including Prime Minister Lee Hsien Loong, were stolen last year.

Confidential information including names, addresses, HIV status and other medical information is reportedly included in the latest breach.

Officials say the details of 5,400 Singaporeans and 8,800 foreigners dating up to January 2013 have been compromised.

• Singapore country profile

Until 2015, foreigners with HIV were not allowed to visit the city state, even as tourists.

Now, anyone who wants to stay beyond 90 days, including for work, is subject to mandatory medical screening to make sure they do not have HIV.

Who was behind the breach?

Officials believe a 33-year-old US citizen who lived in Singapore from 2008 is behind the leak.

Mikhy Farrera-Brochez was convicted and jailed for fraud and drug-related offences in 2016 and was deported last year.

He is the former partner of Ler Teck Siang, the former head of Singapore's National Public Health Unit, who was convicted of helping Farrera-Brochez falsify his medical records to disguise his HIV-positive status.

Officials said Ler offered his own blood labelled as Farrera-Brochez's to allow him entry to the country.

In a statement, the health ministry blamed Ler for the breach, accusing him of not complying with the policies regarding the handling of confidential data.

They said they were first made aware in 2016 that the American may have had confidential information - but thought all material had been seized and secured by police.

Singapore police are reportedly seeking international help in the case

They say they were notified on 22 January this year that Farrera-Brochez could still have possession of the HIV registry data.

"I'm sorry that one of our former staff who was authorised to have access to confidential information in our HIV registry appears to not have complied with our security guidelines," Health Minister Gan Kim Yong said at a Monday news conference, Singapore's Today Online news website reports.

On Monday, health officials said they had tried to contact "virtually all" of permanent resident and Singaporeans on the list - but had only managed to speak to about 900.

A hotline has been set up for those affected, and counselling will be offered, Ministry of Health Permanent Secretary Chan Heng Kee confirmed.

He also said officials believe Farrera-Brochez was abroad, but do not know where.

"There is a risk of him continuing to publicly disseminate the info," Mr Chan warned.