Singapore’s healthcare cyber breaches expose growing risks beyond hospitals, warn experts

Organisations should also monitor for suspicious activity, including unusual access patterns and large data transfers, Prof Wang added.

AI can also help defenders review code, monitor systems and flag vulnerabilities, said Mr Ali. But he cautioned that such tools are not a “silver bullet” and can introduce new security risks if they are not properly configured and managed. 

However, Assoc Prof Razwana said cybersecurity preparedness is unlikely to be uniform across the healthcare sector. 

While larger private healthcare groups may have dedicated cybersecurity teams and greater resources to invest in protective technologies, smaller clinics and independent providers may face tighter budgets and limited access to technical expertise. 

They often depend heavily on external vendors to manage their IT systems, making the security of those providers particularly important, said Assoc Prof Razwana. 

Heavy reliance on common service providers can also create concentration risk, she said, as a compromise at one widely used provider could potentially affect several healthcare organisations.  

In response to CNA’s queries, Raffles Medical Group chief technology officer Terence Foo said it regularly reviews and strengthens its cybersecurity practices in line with the evolving landscape. 

These efforts include ongoing assessments of the system security, risk management and disruption preparedness, as well as working closely with technology partners and vendors.

“While we do not comment on specific measures, monitoring activities or threat assessments for security reasons, we remain attentive to risks and continue to take a risk-based approach on cybersecurity,” he said. 

“We are committed to protecting patient information and maintaining business continuity to support the safe and continued delivery of essential healthcare services.”

But even with such safeguards in place, no organisation can guarantee complete protection against cyberattacks, said experts. 

Assoc Prof Razwana said the more realistic objective is to make successful intrusions harder, limit their impact and ensure that essential healthcare services can continue even when systems are compromised. 

“The focus is not just about securing data,” she added. “It is about protecting patient trust, maintaining continuity of care and safeguarding patient safety.”