Cyber Incident Victim: Ministry of Defence
Date:
Feb 2017
Location:
Singapore
Summary
A targeted cyberattack compromised Singapore's Ministry of Defence, resulting in the theft of personal data belonging to over 850 national servicemen and employees. The breach affected an internet-connected system used for web access in military camps, exposing basic identification details including national ID numbers, phone numbers, and birth dates. Officials confirmed no classified information was accessed due to physical separation between the breached system and secured military networks. The intrusion was characterized as sophisticated and likely not perpetrated by casual hackers or criminal groups. Affected individuals were notified with mandatory password resets and guidance to monitor for suspicious activity, while other government agencies were alerted to review their own systems.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early February 2017, Singapore's Ministry of Defence (Mindef) discovered a cyberattack targeting its internet-connected I-net system, a network of computer terminals used by personnel to access the web within Singapore Armed Forces camps. The breach involved the theft of personal data belonging to 850 national servicemen and employees. Compromised information included National Registration Identity Card numbers, telephone numbers, and dates of birth – basic identification details used for account management purposes. Mindef confirmed the incident publicly on February 28, 2017, characterizing it as a "targeted and well-planned" intrusion. The attackers breached the system's outer layer but did not access classified military information, which remained protected by physical separation from internet-connected networks. David Koh, Mindef's deputy secretary for technology and head of Singapore's Cyber Security Agency, stated the sophistication of the attack indicated it was not the work of casual hackers or criminal gangs, though no specific attribution was provided.
Mindef delayed public disclosure until completing a thorough investigation to assess potential vulnerabilities across its systems. Following containment of the breach, the ministry alerted other government agencies about the attack methodology to facilitate network security checks across Singapore's public sector. Response measures included direct notification to affected personnel, mandatory password resets for compromised accounts, and advisories for victims to monitor for suspicious activity. The incident marked Singapore's most significant military data breach since 2013, when hacktivists aligned with Anonymous targeted government websites. While no operational military systems were compromised, the intrusion highlighted persistent cybersecurity challenges facing defense organizations managing internet-accessible infrastructure alongside classified networks.