Timeline of events leading up to HIV data breach

SINGAPORE — Health Minister Gan Kim Yong revealed new details on the leak of Singapore’s human immunodeficiency virus (HIV) Registry in his ministerial statement in Parliament on Tuesday (Feb 12).

The data breach – announced by the Ministry of Health (MOH) on Jan 28 – was the work of HIV-positive American Mikhy K Farrera Brochez, whose partner Ler Teck Siang was head of the ministry’s National Public Health Unit from March 2012 to May 2013. Ler had access to the HIV Registry.

According to latest media reports, Brochez is now in the United States, where he has been charged with trying to trespass into his mother's house.

The HIV Registry leak affected 14,200 individuals diagnosed with the human immunodeficiency virus and 2,400 of their contacts.

Here is a timeline of events related to the data breach.

2007:

• Ler and Brochez met online and got into a relationship.

2008:

• March: Ler passed his own blood off as Brochez’s in order for Brochez to test negative for HIV. Brochez used the blood-test report to get an Employment Pass from the Manpower Ministry (MOM).

2012:

• Ler was head of the MOH’s National Public Health Unit from March 2012 to May 2013

• Brochez complained to an MOH director that Ler had shared screenshots of the HIV Registry and told another person that he was HIV-positive. According to Mr Gan, Brochez was “uncooperative and evasive” and did not provide evidence to back up his allegation when MOH tried to engage him.

2013:

• Nov: Brochez again used Ler’s blood to retain his Personalised Employment Pass.

• Dec: MOH discovered Brochez may have submitted fake HIV blood tests to MOM. It informed MOM and made a police report. Ler allegedly lied to an investigation manager from MOH’s surveillance and enforcement branch that Brochez had not visited him at Twin City Medical Centre a month earlier, in a bid to halt investigations into the forged blood test.

2014:

• Jan: Ler resigned from MOH. Ler lied to an investigation officer from the Central Police Division that it was Brochez’s blood that had been tested for HIV in November 2013. Brochez told the same lie to the police.

• MOH ordered Brochez to undergo a fresh blood test for HIV but he refused to cooperate.

2016:

• May: First time MOH had evidence that Brochez may have access to confidential HIV data. It lodged a police report. The properties of Ler and Brochez were searched and all relevant materials found were seized and secured by the police.

• June:  Ler and Brochez charged in court under various laws.

• September: MOH implements additional safeguards against the mishandling of information by staff

- A two-person approval process was implemented to download and decrypt registry information to ensure that the information cannot be accessed by a single individual

- A workstation — specifically configured and locked down to prevent unauthorised information removal — was designated for the processing of sensitive information from the HIV Registry.

2017:

• MOH disabled the use of unauthorised portable storage devices on portable computers in 2017 as part of a government-wide policy.

• March: Brochez convicted of fraud and drug-related offences and jailed for 28 months.

2018:

• Feb 26: Ler allegedly administered methamphetamine — a controlled drug — to one Sim Eng Chee in a room at the Swissotel the Stamford hotel.

• March 2: Ler was said to have in his possession a syringe, intended for the administration of a controlled drug. Ler also failed to provide a urine sample to an officer from the Central Narcotics Bureau in the evening.

• April: Brochez was deported from Singapore after completing his sentence

• May: Brochez sent screenshot of 31 records from the HIV Registry to several government authorities. The 31 records were among the 75 that he had given the authorities in May 2016. The MOH decided to alert the 31 individuals.

• Sep: Ler convicted of abetting Brochez to cheat and of providing false information to the police and MOH.

• Nov: Ler sentenced to two years' jail. He lodged an appeal, which will be heard in March 2019. He will also be standing trial from May 29, 2019 for drug-related charges.

• Dec 8: Brochez is arrested in the United States for trespassing on his mother’s home.

2019:

• Jan 22: MOH notified by police that confidential information from its HIV Registry may have been disclosed by an unauthorised person. It filed a police report the next day. 

• Jan 24: MOH determined that that the information matched its HIV Registry records up to January 2013 and "worked with the relevant parties to disable access to the information".

• Jan 26: The ministry began contacting affected individuals to notify them and render assistance.

• Jan 28: MOH went public about data breach.

• Feb 18: Brochez to appear before US district court to face the charge of third-degree criminal trespass. He is currently out on bail.