Singapore HIV registry leak

On 28 January 2019, Singapore's Ministry of Health (MOH) disclosed that the confidential records of 14,200 people diagnosed with HIV had been stolen from the national HIV registry and leaked online. The breach was not a remote hack but an insider-enabled data theft: the data was obtained through a Ministry doctor who had legitimate, privileged access, then exfiltrated and published by his foreign partner.

What happened

The HIV registry is a confidential MOH database recording everyone diagnosed with HIV in Singapore. Ler Teck Siang, a Singaporean doctor, headed MOH's National Public Health Unit from 2012 to 2013 and had authorised access to the registry. His partner, Mikhy Farrera-Brochez, a U.S. citizen living in Singapore, came into possession of the data.

Brochez was a serial fraudster — he had faked his own HIV test (using Ler's blood) to obtain an employment pass — and was convicted of fraud and drug offences in 2017, then deported. Even after deportation, he retained copies of the registry. In January 2019 he published the records online, apparently in an extortion-tinged campaign against the Singapore government. MOH determined Ler had failed to safeguard the data, allowing Brochez to copy it.

Impact

• 14,200 individuals were exposed: 5,400 Singaporeans diagnosed between 1985 and January 2013, and 8,800 foreigners diagnosed between 1985 and 2011.
• Leaked fields included names, NRIC/passport numbers, contact details, HIV test results and related medical information — among the most stigmatising categories of personal data.
• For 2,400 of the records, the contact details of partners and family were also exposed.

Attribution

This was an insider-and-accomplice case, not an external intrusion. Brochez was the one who stole and published the data; Ler Teck Siang was convicted under the Official Secrets Act for failing to take reasonable care of the registry, on top of earlier convictions for abetting Brochez's fraud and for drug offences. Brochez was separately sentenced in the United States to 24 months' imprisonment in 2019 for fraud and aggravated identity theft.

Why it matters

The leak became a defining case in data-governance and insider-risk policy. Because the information could not be recalled once published, MOH could only disable access and monitor the internet for re-disclosure — illustrating the permanence of leaked sensitive data. Singapore responded by tightening controls on the registry: it reduced the number of staff with access, implemented two-person approval and download controls, and disabled the ability to download or print registry data. The case is repeatedly cited across Asia as a cautionary example of how privileged-insider access, not perimeter security, is often the weakest link in protecting highly sensitive health data.