Let's wildly speculate about who hacked Singhealth and how incompetent the response has been.

[PNGMK]

I'm up to three letters now to my house addressed to three different people apologising for the hack.

They can't even get their own data correct.

State actor hacked it? To get at LSL medical data? That's just what the hackers want you to think.

In the meantime my NRIC and enough data related to it float around the deep web. Damn.

[bgd]

How can the hackers monetize the data - is there enough info to be useful and is the quantity large enough? Numbers are pretty small by recent standards.

If they can't then you look to who else might be interested in it, which is where your State actors may come into play. However from the one letter we have received they "say" only identifying data was compromised, not medical records, so doesn't seem that useful. Perhaps the embarrassment factor is enough.

Maybe just some kid in his bedroom experimenting with tools he found on the net.

[PNGMK]

Hi BGD. The problem is there is no obvious way to lock down the system (i.e. stop people misusing the data - i.e. a credit freeze or whatever). All it takes is this data and some reasonably good NRIC cards with the data and they can do a lot of harm to your credit - so yes I think they will be trying to monetize it. Even if it's a state actor they may still offer on the dark web to distract the investigators.

Who hacked it? Someone with a pretty good toolset - I doubt a script kiddie could have done it. It's appalling that it could happen and that the data wasn't properly segmented and separated into DMZ's. I truly hope Singapore Intelligence gets this one sorted. I've never, ever liked having all my data linked to one key (my IC).

[bgd]

I have a certain amount of sympathy for the intrusion, it's difficult to remove the human element.

I get several malicious phishing emails a week. Easy to spot and we have a mechanism to route to a security group who deal with them and also feedback. The same group send out periodic test mails, again easy to spot. But it amazes me how often well trained IT professionals click on these mails. What chance does a government department have?

As to how the data was stored and segregated, that's a different matter.