Statement on third-party cyber incident

Cigna Healthcare Singapore (“Cigna”) has been informed of a cyber incident at Alliance Medinet Pte. Ltd (“Alliance Medinet”), its third-party service provider, affecting several insurers in Singapore. The incident involves the personal data of some members covered under Cigna’s Cigna Care Connect solution. This issue is limited to Alliance Medinet’s systems and Cigna’s platforms have not been impacted in any way. Cigna has notified regulatory authorities, policyholders and affected individuals. There is no disruption to customers’ health insurance coverage or to the processing of their claims.

Alliance Medinet reported unauthorised access to its membership database which has impacted Cigna’s insured members. In Cigna’s notification to each affected individual, we have already identified the specific data relating to the individual which had been compromised on account of the incident. Generally, for most of the affected individuals, the data included names, personal identification numbers and contact information. Based on initial assessment, certain health data of only 1 individual was compromised. Apart from this case, no other health data nor medical records of any affected individual are at risk.

Alliance Medinet has informed Cigna that it has taken measures to contain the incident, and investigations are ongoing. It has engaged independent cybersecurity and forensic specialists and put in place 24-hour network monitoring and dark web monitoring systems. Cigna is working closely with the Service Provider on its investigation.

Customers should remain vigilant for suspicious calls, emails or messages, avoid clicking on unfamiliar links or sharing passwords or one-time passcodes, and verify any unexpected requests with us at customersupport@cignahealthcare.com.

Frequently Asked Questions

Updated as at 2 November 2026

1. What has happened in relation to the recent third-party cyber incident?

Cigna Healthcare Singapore (“Cigna”, “we” or “us”) was informed by its third-party service provider, Alliance Medinet Pte. Ltd. (“Alliance Medinet”), of a cyber incident (the “incident”) involving unauthorised access to the system hosting Alliance Medinet’s membership database (the “system”). This system hosted some of the personal data of Cigna members as well as that of several other insurers in Singapore.

Alliance Medinet has stated that the incident is confined only to the system. Cigna’s own platforms and systems have not been impacted in any way.

Cigna has notified affected policyholders and individuals, as well as the relevant regulatory authorities of the incident. There is no disruption to customers’ health insurance coverage or to the processing of their claims.

2. When did the unauthorized access occur, when was it discovered, and when was it contained?

Based on information provided by Alliance Medinet, the incident was detected on 20 October 2026. Cigna was provided an initial indication of the incident on 21 October 2026 and was provided more details as to how Cigna had been impacted on 22 October 2026.

Alliance Medinet informed Cigna that as of 22 October 2026, they had implemented immediate measures to strengthen system security, mitigate the risk of further attacks and enhance their monitoring capabilities.

We have been further informed by Alliance Medinet that it has appointed independent cybersecurity and forensic specialists, KPMG Services Pte. Ltd. to assist with the Incident. It has validated the security fixes deployed by Alliance Medinet's IT team and confirmed that the unauthorised access path used by the third party has been secured. There is no evidence of further compromise of Alliance Medinet's information system.

3. What personal data was compromised?

In Cigna’s notification to each affected individual, we identified the specific data relating to the individual which had been compromised due to the incident, based on information provided by Alliance Medinet. Generally, for most of the affected individuals, the data included names, personal identification numbers and contact information.

4. Has the threat been fully contained?

We have been informed by Alliance Medinet that it has appointed independent cybersecurity and forensic specialists, KPMG Services Pte. Ltd. ("KPMG") to assist with the Incident. Investigations are ongoing to establish the full extent and circumstances of the Incident. Alliance Medinet has also informed us that KPMG has validated the security fixes deployed by Alliance Medinet's IT team and confirmed that the unauthorised access path used by the third party has been secured as at 26 October. There is no evidence of further compromise of Alliance Medinet's information system.

5. Has Cigna reported this incident to the relevant authorities?

Cigna notified regulatory authorities promptly after being notified of the cyber incident. The incident has been reported to the Monetary Authority of Singapore (MAS) and the Personal Data Protection Commission (PDPC).

6. Who is the third-party vendor, what services does it provide, and why did it have access to my information?

Like many other insurers, Cigna works with third-party service providers in various markets to support clients and members insured under Cigna’s plans.

Alliance Medinet is Cigna’s appointed third-party administrator for Cigna’s Care Connect Solution. In this capacity, Alliance Medinet provides customer servicing, claims administration and other related administrative services and processes personal data on Cigna’s behalf.

Cigna conducts robust vendor due diligence before engaging third parties, including an assessment of the vendor's capabilities and cybersecurity controls. We also impose on our vendors cybersecurity and data protection obligations to meet applicable regulatory and other contractual requirements. Cigna also maintains ongoing oversight of its third-party relationships as part of its risk-management process.

7. How do I know whether I — and each of my dependents — were affected?

We promptly notified all affected policyholders and insured members after being informed of the cyber incident. If you have received a notification, our investigation indicates that you and/or your dependant(s) information may have been involved in the incident. The notification identifies the specific data relating to you and/or your dependant(s) that may have been compromised as a result of the incident. As we suggested in the notice, please inform your dependent(s) of the incident and the precautionary steps outlined in the notice.

8. I’m concerned my personal data has been compromised – what should I do and who should I contact?

If you have received a notification from us, our investigations indicate that your information may have been involved in the incident.

As a precaution, you should remain vigilant against unsolicited calls, emails, text messages or other communications requesting personal, financial or account-related information. Always exercise caution before disclosing personal information and verify the identity of any party requesting such information. Please refer to Cigna Customer Cyber Security Awareness tips shared in Customer Cyber Security Awareness | Cigna Singapore.

For further information or assistance, please contact our dedicated helpline at customersupport@cignahealthcare.com.

9. Will my ability to make a claim be impacted?

There is no disruption to any of Cigna’s healthcare insurance coverage or to the processing of your claims.

10. Will this incident disrupt access to medical services?

No. Your Cigna healthcare insurance coverage and claims processing remain unaffected. Alliance Medinet’s systems are operational, and members can continue to access medical services and care providers as normal.

11. What is Alliance Medinet, the third-party service provider, doing to limit identity theft?

Based on information provided by Alliance Medinet, upon discovery of the cyber incident, it acted immediately to contain the incident and engaged independent cybersecurity and forensic specialists to support a formal investigation and further enhance their IT systems, processes and security controls. They have also put in place 24-hour network monitoring and dark web monitoring.

12. How is Cigna preventing fraudulent claims or changes to my membership record?

We have been informed by Alliance Medinet that it has appointed independent cybersecurity and forensic specialists, KPMG Services Pte. Ltd. to assist with the incident. It has validated the security fixes deployed by Alliance Medinet's IT team and confirmed that the unauthorized access path used by the third party has been secured. At this point, there is no evidence of further compromise of Alliance Medinet's information system. 

13. What will Cigna do to rectify this and avoid similar incidents in the future?

The incident occurred within Alliance Medinet’s systems and did not result from a compromise of Cigna’s systems. Cigna applies robust onboarding, outsourcing and information-security requirements, together with ongoing oversight throughout the relationship when working with third-party providers and this was also the case with the engagement of Alliance Medinet.

We are closely monitoring Alliance Medinet’s remediation measures and will assess the final investigation findings to determine whether any further safeguards should be introduced.

14. What actions or precautions should I take to protect myself from identity theft or fraud?

As a precaution, you should remain vigilant against unsolicited calls, emails, text messages or other communications requesting personal, financial or account-related information. Always exercise caution before disclosing personal information and verify the identity of any party requesting such information. Please refer to Cigna Customer Cyber Security Awareness tips shared in Customer Cyber Security Awareness | Cigna Singapore.

15. What should I do if I receive a suspicious message referring to my Cigna coverage or personal details?

If you receive a suspicious message referring to Cigna’s coverage or require any support, please reach out to us at customersupport@cignahealthcare.com.

16. What should I do if I believe my identity or personal information has already been misused?

We have set out guidance in the notifications sent to affected individuals. The following resources may also be helpful:

24/7 ScamShield Helpline (1799): Call ScamShield Helpline to check if something is a scam or get directed to your bank immediately if you are a victim.

• ScamShield Website & App: Visit the ScamShield Website to download the free iOS or Android app to filter scam calls and messages (via SMS, WhatsApp, and Telegram). The portal also features live scam trends, safety tips, and a live chat.
• Anti-Scam Resource Guide: Download the multi-lingual Anti-Scam Resource Guide (available in English, Mandarin, Malay, and Tamil) for a step-by-step breakdown of the scam investigation process and support channels.
• Singapore Police Force Advisories: Check official updates and red flags on the SPF Scams Advisory Page.

Cigna Singapore’s website also has an advisory on Customer Cyber Security Awareness.

17. Could someone access my Cigna account or claims history using the compromised information?

Alliance Medinet has confirmed that no login credentials have been compromised.  As such it should not be possible to access the Cigna account or claims history using the compromised information. However, as an additional precaution, members may wish to consider changing their login credentials.

18. Is it safe to continue using Cigna’s digital services?

The incident is limited to Alliance Medinet’s systems and Cigna’s platforms have not been impacted in any way. Cigna had only appointed Alliance Medinet as a third-party administrator for one Cigna solution, i.e., Cigna Care Connect, hence the incident has only affected certain individuals covered under that solution. No other Cigna solutions are affected.

In respect of Cigna Care Connect, we have been informed by Alliance Medinet that it has appointed independent cybersecurity and forensic specialists, KPMG Services Pte. Ltd. to assist with the Incident. It has validated the security fixes deployed by Alliance Medinet's IT team and confirmed that the unauthorised access path used by the third party has been secured. At this point, there is no evidence of further compromise of Alliance Medinet's information system.

19. Should I change my passwords?

Alliance Medinet has confirmed that no login credentials have been compromised.  Even so, as a precaution, members are encouraged to re-set their password.

20. Can I request access to, correction of, or deletion of personal information held by Cigna or Alliance Medinet?

You may make such requests by way of Cigna’s usual processes for handling such matters and subject to the PDPA, and the policies that are applicable to you. Such requests will be considered on a case-by-case basis and handled in accordance with our usual procedures. The PDPA does not provide for a general right to deletion of personal data and we may in any event need to retain certain personal data for legal or business purposes, including to administer your insurance coverage and process your claims.

21. How will Cigna members be kept up to date?

As mentioned above, Alliance Medinet has appointed independent cybersecurity and forensic specialists, KPMG Services Pte. Ltd.  to assist in containing, remediating and carrying out forensic investigation with respect to the incident.

We will provide further updates if there are any material developments or changes as the investigation progresses. Once KPMG's investigation has concluded, we will provide a summary of the information we are able to share. You may also check this page for any updates.

22. How will Cigna notify members if the investigation identifies additional exposed information?

If investigations identify further exposed information, as with the previous notification, Cigna intends to inform affected members via direct email communications sent to the email address on Cigna’s records. We will provide more general updates on our website.

23. I understand Cigna Care Connect products are impacted – what does this mean for all of Cigna’s other products?

As the Cigna Care Connect solution is the only Cigna product supported by Alliance Medinet, the impact of the cyber incident is limited to some members insured under that solution.

This incident does not impact members insured under other Cigna solutions, for example, Cigna Prime/Spectrum and Cigna Global Health Options.

24. What support is available for affected members?

We understand that affected individuals have concerns regarding the impact of this incident. Our immediate priority is to support affected individuals and continue to work with Alliance Medinet on their investigation with the assistance of independent cybersecurity and forensic specialists.

Alliance Medinet remains committed to working closely with affected stakeholders throughout this process.

If you require any support, please reach out to us at customersupport@cignahealthcare.com.

25. Who can I contact directly about the incident?

For further information or assistance, please contact our dedicated helpline at customersupport@cignahealthcare.com.