Why Singapore Experiences So Many Cyber Attacks?

Singapore is one of the most digitally advanced nations in the world, but like many other destinations, it has room for improvement regarding cybersecurity. Unfortunately, making progress in that area won’t be easy, and that’s largely because many things contribute to the elevated cyberattack risk in Singapore.

Health Records Recently Seized

Medical data is of particular interest to hackers, since each record potentially contains a wealth of information ranging from personal details to health diagnoses and treatments. In mid-May 2019, the Singapore Red Cross (SRC) announced that unauthorized access to a section of its website resulted in the breach of details associated with 4,297 potential blood donors.

The SRC immediately notified the authorities and began working with external consultants to determine what caused the breach. Preliminary findings indicated that a weak administrator password might have been to blame.

The article that reported on the SRC hack made clear that the incident is far from the only one involving the sensitive data of people in Singapore. In January, an HIV-positive American who was jailed there and subsequently deported allegedly leaked the data of more than 14,000 people diagnosed with HIV. Reports say he got the information from his partner, a physician.

Then, in March, the Singapore Health Sciences Authority (HSA) disclosed another incident of compromised blood donor data. That issue was much larger than the SRC event, affecting the personal information of 800,000 people who either donated blood or registered to do so since 1986.

Hacked Medical Content Could Facilitate Blackmail

According to insights from cybersecurity experts, hackers don’t only want health records for the data contained within that they could sell. They also prize health data because of how it could be instrumental in blackmailing a person of power.

For example, if a hacker obtains a record that says a prominent government official in Singapore has an inoperable brain tumor, that person could threaten to make the information public. This could incite public doubt in the person’s ability to perform duties — unless the victim pays a specified amount for silence.

In the summer of 2018, SingHealth, one of the two major government health groups in Singapore, was hacked. Singapore’s prime minister was among the 1.5 million victims. When cybersecurity analysts weighed in, one of them said such hacks are a new form of spying that helps nations gain diplomatic advantages.

Reports also mentioned that the prime minister was one of the 160,000 individuals who had information about prescribed medications taken during the hack. Such data could make it relatively straightforward to narrow down the health conditions the prime minister may have, leading to potential blackmail.

No Single Issue to Conquer

Unfortunately, as Singaporean authorities and residents discuss how to improve their cybersecurity readiness, they’ll inevitably realize that there is not a primary issue causing most or all of these attacks. For example, an investigation into the SingHealth hack revealed numerous failures, spanning from system vulnerabilities to employees failing to follow or not being aware of cybersecurity procedures.

In the situation with the hacked data from HIV-positive patients, the physician who had access once held a government position and transferred the information onto a USB drive at work. However, the person did not return the drive upon leaving their job. In that case, the employer might have failed to enforce — or perhaps did not have — rules regarding surrendering confidential data or company hardware.

Then, last year, the Cyber Security Agency (CSA) of Singapore released the results of its annual survey about cybersecurity awareness practices. It collected 2017 data and showed some positive signs, but highlighted how not adhering to some cybersecurity best practices could leave some internet users at risk for attacks.

The CSA poll found a reduction in the percentage of people connecting to open Wi-Fi networks in public places. It also saw an increase both in the number of people choosing to download apps from official stores and in those who check a website’s authenticity before moving forward with online transactions.

There were mixed findings concerning passwords, though. The good news is that awareness of two-factor authentication (2FA) went up. However, the survey showed no improvement in the ways people manage their passwords compared to 2016. About one in three people write them down or store them in their computers. Moreover, the majority of respondents don’t change them regularly or only do so when prompted.

Earning the Reputation of Southeast Asia’s Silicon Valley

One of the reasons hackers may target Singapore frequently is that numerous vulnerabilities exist, and cybercriminals know fixing them will not be a quick, foolproof process. Additionally, Singapore is rapidly getting a reputation as being Southeast Asia’s version of Silicon Valley.

Its prominence as a tech hub brings investments flooding into Singapore’s startups. However, the cybersecurity issues could hamper growth in the technology sector, and the city-state at large. As one example, a Singaporean cryptocurrency company and exchange called DragonEx was hacked not long ago, and the criminals took an undisclosed amount of cryptocurrencies.

Hackers could take notice of the growing number of tech companies in Singapore and conclude that there are plenty of ways to orchestrate successful cyberattacks.

Business-Related Cyberattacks Rising

It also doesn’t hurt that Singapore is one of the wealthiest nations in the world, making it an especially lucrative target. A report indicates that the more than 125 foreign and local banks operating in the country show deposits from commercial clients totaling the equivalent of $449 billion.

It’s not surprising, then, that a press release covering findings from a Trend Micro report mentioned that Singapore experiences the most business email compromise (BEC) attacks, accounting for 27.3% of all nations in Southeast Asia. It said that the average yield for such attacks was $177,000 in Singaporean currency. A different, recent report from Carbon Black shows more than 90% of Singaporean businesses suffered multiple hacks over the past year.

A BEC attack is a type of phishing attempt where a cybercriminal poses as a person in authority and uses social engineering to encourage email recipients to give up personal details. The Trend Micro data registered a 28% global increase in BEC incidents, too.

It’s necessary to point out here that many BEC attacks don’t include a malicious link for a victim to click or a file for them to download. Instead, the message content is usually brief, personalized and relevant to a person’s line of work or specific job.

However, Trend Micro warned that Singapore is also home to an above-average number of malicious URLs. It referred to Singapore as Southeast Asia’s “most vulnerable country” and cited it hosts in excess of 3 million dangerous URLs. Plus, more than 15 million people engage with them.

A Complicated and Concerning Matter

The information here shows there is not an easy solution to fix Singapore’s cybersecurity weaknesses. Factors such as the wealth of the nation and password-related shortcomings from the majority of internet users in the country contribute to the issue. As such, a collective effort is necessary to kickstart positive change.