Names, workplaces of patients with hereditary cancer allegedly exposed in 'administrative error' at National Cancer Centre

An email invitation sent by the National Cancer Centre Singapore (NCCS) has allegedly exposed the names and contact details of individuals with a hereditary cancer condition, including their workplaces in some cases.

Recipients were listed in the carbon copy (CC) field instead of the blind carbon copy (BCC) field due to an "administrative error".

Email invitation for an event

According to a report by The Straits Times (ST), the invitation was for an event titled "Living with HBOC".

HBOC refers to Hereditary Breast and Ovarian Syndrome, a hereditary cancer predisposition condition that can affect both men and women.

The invitation was reportedly sent to the NCCS’ list of individuals associated with the condition on Sep. 18.

However, recipients were able to see the names and email addresses of other invitees as the blind carbon copy (BCC) function was not used.

Instead, recipients were included in the carbon copy (CC) field.

This meant that the email addresses of other people on the mailing list were visible to recipients.

In cases where individuals had used their workplace email addresses, their workplaces could also be identified.

Recipients were asked to delete the email

According to ST, NCCS attempted to recall the email around two and a half hours later.

Recipients later received a second email, asking them to delete the earlier invitation from both their inboxes and trash folders.

They were also asked not to circulate the email further and not to use or save any of the email addresses contained in it.

The follow-up e-mail reportedly read: "Please be assured that this was an administrative error that affected e-mail addresses only. We are thoroughly reviewing our internal processes to ensure that this does not happen again."

A check on NCCS' website showed that the event, which is scheduled for Oct. 31, is organised for people with the HBOC syndrome.

The event also appears to be by invitation only.

The person who sent the email appeared to be a member of NCCS’ Cancer Genetics Service, ST reported.

NCCS’ Cancer Genetics Service is a specialised unit that provides genetic counselling, risk assessment and testing for people with a personal or family history of cancer.

Over 500 email addresses allegedly exposed

One recipient told ST that the number of email addresses revealed were "too numerous to count" and could be more than 500.

They added that the email domains revealed the companies, foreign embassies, and schools associated with those on NCCS’ HBOC mailing list.

"It ties identifiable people directly to a health condition, which is a more sensitive category of personal data than a typical CC mishap," the individual said.

They said they were worried that people they had never met would know about their genetic condition, and cited concerns that it could affect their work or insurance one day.

In response to Mothership's queries, the Personal Data Protection Commission said it is aware of the incident and investigating.

Mothership has reached out to NCCS and SingHealth for comment.