State-actors likely behind Singapore cyber attack, say security experts

SINGAPORE: State-actors were likely behind Singapore’s biggest ever cyber attack to date, security experts say, citing the scale and sophistication of the hack.

The city-state announced on Friday that hackers had broken into a government database and stolen the health records of 1.5 million Singaporeans, including Prime Minister Lee Hsien Loong who was specifically targeted in the “unprecedented” attack.

Singapore’s health minister said the strike was “a deliberate, targeted, and well-planned cyber attack and not the work of casual hackers or criminal gangs”.

While officials refused to comment on the identity of the hackers citing “operational security”, experts said that the complexity of the attack and its focus on high-profile targets like the prime minister pointed to the hand of a state-actor.

“A cyber espionage threat actor could leverage disclosure of sensitive health information... to coerce an individual in (a) position of interest to conduct espionage” on its behalf, said Eric Hoh, Asia-pacific president of cyber security firm Fireeye.

Hoh told national broadcaster Channel Newsasia that the attack was an “advanced persistent threat”.

“The nature of such attacks are that they are conducted by nation states using very advanced tools,” he said.

“They tend to be well resourced, well-funded and highly sophisticated.”

Healthcare data is of particular interest to cyber attackers because it can be used to blackmail people in positions of power, said Jeff Middleton, Chief Executive of cyber security consultancy Lantium.

“A lot of information about a person’s health can be gleaned from the medications that they take,” Middleton said on Saturday.

“Any non-public health information could be used for extortion. Russian spy services have a long history of doing this,” he added.

Medical information, like personal data, can also be easily monetised on criminal forums, said Sanjay Aurora, Asia Pacific managing director of Darktrace.

SINGAPORE OFFICIALS CONCLUSIONS ABOUT THE ATTACKERS