It was revealed by the Singapore Ministry of Health that HIV-positive status of 14,200 people, along with their names, identification numbers, phone numbers, addresses and other health information, were stolen and illegally leaked to the internet by an American citizen.
The leaked records belonged to 5,400 Singaporeans diagnosed with HIV up to January 2013, and 8,800 foreigners diagnosed up to December 2011, the health ministry said.
The name, identification number, phone number and address of further 2,400 people identified through contact tracing up to May 2007 was also included.
The ministry continued by saying that the information was leaked by Mikhy K. Farrera Brochez, a U.S. citizen who was living in Singapore on an employment pass until May 2018.
Brochez himself was convicted on numerous fraud offenses related to his own HIV status, which he lied about “in order to obtain and maintain his employment pass,” the ministry said. He was sentenced to 28 months in prison.
It began when Brochez partner, a Singaporean doctor named Ler Teck Siang who was head of MOH's National Public Health Unit (NPHU) from March 2012 to May 2013.
Brochez and Ler were acquainted through a gay dating website and met in person for the first time in Hong Kong in 2007. By January the next year, Brochez moved to Singapore and was living with Ler in his Craig Road apartment.
Looking for a job, Ler helped Brochez lie about his HIV status by replacing Brochez blood with his own on a test, falsifying the declaration in the application in 2011 in order to get Bronchez a Personalized Employment Pass (PEP).
Apparently, the doctor also had access to the HIV Registry for his work, and had downloaded the information of HIV-positive patients to his thumb drive. This information fell to Brochez's hands.
The doctor was then convicted and sentenced to 24 months in prison for helping Brochez "commit cheating" and for lying to the authorities, and also faces charges under the Official Secrets Act for “failing to take reasonable care of the confidential information regarding HIV-positive patients,” the ministry said.
After deporting Brochez, the health ministry found that Brochez still had the records, in which he subsequently began posting them online.
The ministry said it was notified by the police on January 22 that confidential information of HIV patients had been leaked, and made a police report the following day.
The ministry believes Len’s “mishandling” of the information led to the leak.
The ministry then contracted the authorities, and the police started seeking help of their foreign counterparts in their investigation. This led to the arrest of Brochez at his mother's house in Clark County, Kentucky, charged after trying to trespass her property.
The ministry said it has added additional safeguards to prevent mishandling of information in the future, including a two-person approval to download and decrypt registry information. The ministry has also put in place a workstation made specifically to prevent unauthorized information being removed.
Additionally, the use of unauthorized portable storage devices on official computers was also disabled.
“We are sorry for the anxiety and distress caused by this incident,” the ministry said. “Our priority is the well-being of the affected individuals. Since Jan. 26, we have been progressively contacting the individuals to notify them and render assistance.”
Police in Singapore said they would prosecute anyone found sharing the leaked HIV Registry data under the Official Secrets Act.
"Police will not hesitate to take stern action, including prosecution, against those who have breached the OSA. A person found guilty of the wrongful possession, communication or use of confidential data shall be liable to a fine not exceeding S$2,000 [roughly $1,500 US], and to imprisonment for a term not exceeding two years," a police statement said.
