Representational Image.
A day after the biggest ever breach of personal data in Singapore, wherein hackers stole information of 1.5 million patients, security officials said that state-actors were likely behind the cyber-heist.
Earlier on Friday, the Singapore government announced that hackers had broken into a government database and stole the health records of 1.5 million Singaporeans, including Prime Minister Lee Hsien Long.
Singapore's health minister said the strike was "a deliberate, targeted, and well-planned cyberattack and not the work of casual hackers or criminal gangs".
While officials refused to comment on the identity of the hackers citing 'operational security', experts told media that the complexity of attack and its focus on high-profile targets like the prime minister pointed to the hand of a state-actor.
"A cyber espionage threat actor could leverage disclosure of sensitive health information... to coerce an individual in (a) position of interest to conduct espionage" on its behalf, said Eric Hoh, Asia-Pacific president of cybersecurity firm FireEye.
Hoh told national broadcaster Channel NewsAsia that the attack was an "advanced persistent threat".
"The nature of such attacks are that they are conducted by nation states using very advanced tools," he said.
"They tend to be well resourced, well-funded and highly sophisticated." Healthcare data is of particular interest to cyberattackers because it can be used to blackmail people in positions of power, said Jeff Middleton, chief executive of cybersecurity consultancy Lantium.
Medical information, like personal data, can also be easily monetised on criminal forums, said Sanjay Aurora, Asia Pacific managing director of Darktrace.
"Beyond making a quick buck, a more sinister reason to attack would be to cause widespread disruption and systemic damage to the healthcare service - as a fundamental part of critical infrastructure - or to undermine trust in a nation's competency to keep personal data safe," he added.
Singapore is hyper-connected and on a drive to digitise government records and essential services, including medical records which public hospitals and clinics can share via a centralised database.
But authorities have put the brakes on these plans while they investigate the cyberattack. A former judge will head an inquiry looking into the incident.
Singapore officials have cautioned against jumping to conclusions about the attackers.
"With regard to the prime minister's data and why he was targeted, I would say that it's perhaps best not to speculate what the attacker had in mind," said David Koh, head of Singapore's Cyber Security Agency.
The hackers used a computer infected with malware to gain access to the database between June 27 and July 4 before administrators spotted "unusual activity", authorities said.
While Singapore has some of the most advanced military weaponry in the region, the government says it fends off thousands of cyberattacks every day and has long warned of breaches by actors as varied as high-school students in their bedrooms to nation states.
Earlier this month US intelligence chief Dan Coats described Russia, China, Iran and North Korea as the "worst offenders" when it came to attacks on American "digital infrastructure".
