US citizen leaks data of 14k HIV+ people in Singapore

An HIV-positive American who had been deported from Singapore after serving a jail term has leaked online the personal data of 14,200 Singaporeans and foreigners diagnosed in the city-state with the virus.

The disclosure by Singapore's health ministry late Monday, coming after last year's news of a major cyber attack on its national health database, could further dent the highly wired state's push to place itself as a data and health care hub.

U.S. citizen Mikhy Farrera Brochez lived in Singapore from 2008 and was convicted in 2017 on numerous drug-related and fraud offences, including lying to the Ministry of Manpower about his own HIV status.

Last week, Brochez disclosed online the personal information including the names, ID numbers, phone numbers and addresses of 5,400 Singaporeans diagnosed with HIV up to January 2013 and 8,800 foreigners diagnosed up to December 2011.

In response to the AIDS epidemics in the 1980s, many countries introduced restrictions on entry against HIV-infected travellers and foreign workers. Singapore remains among a small number of developed countries that maintain some restrictions on long-term visit passes and work visas.

The Health Ministry had become aware in May 2016 that Brochez was in possession of confidential information that appeared to be from the country's HIV Registry.

Last week, it learned that he could still be in possession of the data, the ministry said.

Brochez was HIV-positive and used his Singaporean doctor partner's blood sample to pass blood tests so he could work in Singapore, the ministry said in a statement. His partner previously had access to the HIV registry for his work, it said.

The ministry did not say how Brochez obtained the data or suggest a motive for leaking it online but said only that the partner was believed to have "mishandled" the information.

"I am sorry that one of our former staff who was authorised to have access to confidential information in our HIV registry appears to not have complied with our security guidelines,” Health Minister Gan Kim Yong said.

"This may have led to an unauthorised person gaining possession of the data and disclosing it online," he said.

Brochez was deported after serving his jail term and was now overseas, according to the ministry statement, which did not say where.

Singapore-based advocacy group Action for AIDS said the case has the "potential of damaging the lives of persons living with HIV and their loved ones."

"This is a criminal act that should be condemned and answered in the most severe terms possible," it said.

Brochez is currently under police investigation, and the authorities are seeking assistance from their foreign counterparts, according to the ministry statement, which did not specify any country.

Reuters could not reach Brochez for comment.

The ministry said it had worked with the "relevant parties" to disable access to the information. It did not say where it was leaked online.

Last year, Singapore revealed that personal information of about 1.5 million people including the prime minister was stolen after hackers infiltrated the government health database. The HIV information leak was not related to the cyber breach.