Singapore’s AIC says data of up to 4,064 care staff may have been accessed

Singapore’s Agency for Integrated Care (AIC), the agency that coordinates aged care and community care services, said on November 12, 2026 that an unauthorised third party got into its Advance Care Planning IT system. The personal data of up to 4,064 employees of public healthcare institutions and community care providers may have been accessed. The same day, the Ministry of Health said AIC was one of six healthcare-related organisations hit by cybersecurity incidents in the past two weeks. Here’s what is known, and what affected staff should do.

What AIC has said

According to AIC’s statement, as reported by CNA and The Straits Times:

• What was reached: the Advance Care Planning (ACP) IT System. Trained facilitators use it to help members of the public record their decisions about future care.
• Whose data: up to 4,064 staff of public healthcare institutions and community care providers. These are the people who use the system, not the members of the public whose care plans are recorded in it.
• Which details: names, contact numbers, email addresses and NRIC numbers.
• What was not reached: AIC says there are no indications that medical records or patient data were compromised, and no other systems were affected.

Timeline

• November 10: AIC detected the unauthorised access, made a police report and told the Cyber Security Agency of Singapore (CSA). It took the ACP system offline as a precaution, and facilitators went back to paper forms.
• November 12: AIC restored the system and published its statement.
• Within three days of the statement: AIC says it will contact everyone who may be affected.

AIC said it will carry out a thorough review of its systems and work with CSA on immediate measures to strengthen its defences. It has not said how the intruder got in or whether any data was copied.

Six incidents in two weeks

In a statement on November 12, Singapore’s Ministry of Health named six healthcare-related organisations that have reported incidents recently: AIC, Alliance Medinet, Doctor Anywhere Group, Fullerton Health Group, Minmed Group and Dementia Singapore, whose CARA mobile app was affected. MOH said the incidents have not disrupted patient care, that there is no evidence so far that patient safety or care has been compromised, and that it is not aware of any unauthorised access to patient health records.

Mothership summarised what each organisation has disclosed. The details differ from case to case: Alliance Medinet said about 110,000 members were affected, Fullerton Health said a server for a migrant worker primary care programme was accessed, and Dementia Singapore told CARA users that names, emails, phone numbers and membership IDs may have been exposed. Neither MOH nor the organisations have said the incidents are connected, and nobody has publicly named a single attacker behind them.

MOH has asked Synapxe, the national health technology agency, and the public healthcare institutions to step up monitoring, and urged private providers and health record system vendors to review their defences. It said AI is making attacks “more frequent, rapid and formidable.”

What this means for you

A name, phone number and email together with an NRIC number is enough for a convincing impersonation call. A scammer could pretend to be AIC, a hospital HR team, the police or a bank and quote your NRIC to sound official. AIC’s own advice is to be careful with unexpected emails, messages and calls, and never to share personal information, passwords or one-time passwords with someone whose identity you can’t confirm.

What you can do

1. If you work in public healthcare or community care in Singapore and have used the ACP system, watch for AIC’s notice. AIC says it will contact everyone who may be affected.
2. Check with AIC directly if you’re unsure. AIC gave its hotline, 1800-650-6060, and the email address enquiries@aic.sg for people who think they may be affected. Use those, not a number or link in a message you received.
3. Treat calls that quote your NRIC with suspicion. Hang up and call the organisation back on a number you looked up yourself.
4. Never share one-time passwords, Singpass approvals or bank codes with a caller, whatever reason they give.
5. If you use one of the other five services MOH named, read the notices those organisations have sent and follow their advice.

How Frame helps

AIC hasn’t published a list of affected email addresses, so there isn’t a breach record to add in Frame yet. If you receive AIC’s notice, add the breach to a verified email in Frame for a short checklist of what to do. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• How scammers use leaked data to make phishing personal, and how to spot it: why an ID number in a message makes it more convincing, not more trustworthy.
• Calls that show “RCMP” on caller ID are hitting Albertans. The number can be faked: how impersonation calls borrow an official name.

Sources

• CNA, Data of over 4,000 healthcare, community care employees potentially accessed in AIC cybersecurity incident, November 12, 2026
• The Straits Times, Data breaches: Patient care not affected, says MOH; AIC latest to report cybersecurity incident, November 12, 2026
• AsiaOne, Recent cybersecurity breaches across 6 healthcare-related entities highlight need for stronger defences: MOH, November 12, 2026
• Mothership, No evidence that patient safety & care compromised: MOH on cybersecurity incidents involving 6 healthcare entities, November 12, 2026