File-borne breach events · Southeast Asia
Singapore: documented file-borne breach events
Singapore's record pairs the country's largest breach, SingHealth, whose Committee of Inquiry traced entry to a phishing email carrying malicious code, with the 2019 ST Logistics incident, where the regulator's published decision names the exact malicious .doc attachment.
Overview
What the record shows
Singapore is rare in that its investigations publish detail. The SingHealth Committee of Inquiry produced a 454 page public report on the country's largest breach, and the Personal Data Protection Commission publishes grounds of decision that record vectors precisely: the 2019 ST Logistics decision names the date of the phishing wave, the .doc attachment, the number of users who opened it and the Emotet infection that followed.
The SingHealth entry reflects the Committee's own wording. It assessed that initial entry was "likely by way of a phishing email containing malicious code" while recording that the initial infection's source could not be conclusively determined; this page carries that qualification rather than flattening it. The email itself is a file crossing the boundary, which is why the event belongs on this record.
Documented events
File-borne incidents in Singapore
Most recent first. Every entry cites the public record it is drawn from.
-
ST Logistics Pte Ltd: Defence personnel data put at risk after staff opened a malicious .doc attachment carrying Emotet
ST Logistics, a logistics vendor to Singapore's Ministry of Defence and armed forces, suffered an Emotet infection that placed unencrypted files holding personal data of about 2,400 MINDEF and SAF personnel at risk, with up to 4,000 individuals potentially affected. MINDEF disclosed the incident on 21 December 2019, and the Personal Data Protection Commission's grounds of decision, which documents the vector, imposed a financial penalty in 2021. No evidence of actual data leakage was found.
The documented vector. Malicious .doc email attachments delivering the Emotet trojan. On 2 October 2019, ST Logistics staff received phishing emails spoofing internal senders, each carrying an attachment with the file extension .doc. The PDPC's published decision records that 13 users opened the malicious attachment, after which Emotet installed on laptops, harvested mailboxes and sent around 100 further phishing emails.
How this class of vector is removed
This class of vector, a macro-bearing document attachment delivering a commodity trojan, is a supported document format and is removed by deterministic rebuild: the .doc is reconstructed to the format's known good specification and its macros and other active content are stripped before the file reaches a user, with no dependence on any recipient spotting the spoof. The Email CDR Relay applies that rebuild to inbound mail before delivery.
Content Disarm and ReconstructionEmail CDR RelayGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- logistics
Source: Personal Data Protection Commission · Source: Personal Data Protection Commission · Source: Ministry of Defence Singapore
-
Singapore Health Services (SingHealth): 1.5 million patients' data taken; the COI recorded CSA's hypothesis that entry came by a phishing email
Attackers compromised a front end workstation around 23 August 2017, moved laterally for months, and between 27 June and 4 July 2018 exfiltrated the personal particulars of about 1.5 million patients plus the outpatient dispensed medicine records of about 160,000, including the Prime Minister, who the Ministry of Health said was specifically and repeatedly targeted. The breach was disclosed on 20 July 2018, and the Committee of Inquiry's public report of January 2019 remains the authoritative account.
The documented vector. Phishing email, recorded by the COI as CSA's hypothesis for the initial entry and not conclusively determined; a hacking tool was later installed via an unpatched Outlook vulnerability. The Committee of Inquiry's public report recorded CSA's hypothesis that the initial intrusion into SingHealth's network was via a phishing email containing malicious code, a hypothesis CSA based on a phishing email sent on 18 July 2018 when the attacker attempted to regain a foothold. The report states that CSA was unable to determine conclusively what the source of the initial infection was, and describes the evidence for a phishing entry as "not conclusive". The report also documents that a publicly available hacking tool was used to drop malware onto the front end workstation by exploiting an unpatched Microsoft Outlook vulnerability.
How this class of vector is removed
The record carries a phishing email as CSA's hypothesis for the class of vector and does not establish what the message carried. Inbound mail is processed before it reaches anyone rather than trusted on the strength of its sender, and a carried document is rebuilt to its format's known good specification, which is what this class of vector usually turns on and does not depend on the reader spotting anything. The Committee recorded the phishing entry as a hypothesis whose source could not be conclusively determined, so this is held at low confidence.
Email CDR RelayContent Disarm and ReconstructionGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- healthcare
Source: Committee of Inquiry, Government of Singapore · Source: Ministry of Health Singapore
Scope
How to read this page
Every event on this page meets three tests before it is published. It is documented by reliable public sources: a regulator, an official inquiry, the affected organisation's own disclosure, or reputable press with named confirmation, and each entry links to those sources. The initial access or payload delivery travelled as a file, as the public record states it. And where an entry carries a prevention analysis, that analysis is bounded by what we can evidence; where an entry carries none, that is deliberate.
About the organisations named here. They are named because the public record names them, and for no other reason. Nothing on this page alleges fault, negligence or any breach of duty by any organisation or individual, and nothing here should be read as saying that anyone acted improperly or that their security arrangements were inadequate. Being attacked is not evidence of either, and the organisations on this page include some of the most heavily defended in the region. We summarise what published sources report and link to them so you can read them yourself. We have not independently investigated any incident and we hold no non-public information about any of them. Names are used to identify the organisations concerned; no affiliation with them, and no endorsement by them, is implied, and all trade marks remain their owners'.
About the prevention analysis. Where an entry describes how a class of vector is addressed, that is a general statement about how a control treats that class of content. It is not a claim that our products were in use, that they would have been deployed in that architecture, or that they would have prevented that incident. It is not an assessment of any organisation's actual controls, which we do not know. What a control achieves in practice depends on configuration, deployment and file type. Where an entry carries no prevention analysis, we are making no claim about that event either way.
Generally. This page is a working reference, not an incident report, a security assessment or legal advice, and it is provided without warranty. Details reflect the public record on the review date and may have changed since. If you believe anything here is inaccurate, incomplete or out of date, tell us and we will review it promptly and correct it where the record supports that.
Elsewhere in the region