Love, lies, leak: Timeline of HIV Registry data breach

Ler Teck Siang (left) and Mikhy Farrera Brochez are at the centre of a high-profile data breach in the healthcare sector that came to light on Jan 28, 2019.

• 2007: Ler Teck Siang and Mikhy Farrera Brochez connect through a gay dating website and meet in Hong Kong. By January 2008, he moves in with Ler here.

• March 11, 2008: Brochez tests positive for HIV under a fake passport at a Singapore Anti-Tuberculosis Association (Sata) clinic.

• March 13, 2008: Ler uses own blood instead of Brochez's to help him pass a blood test and get an employment pass.

• February 2011: Brochez applies for and gets a Personalised Employment Pass (PEP).

• March 2012 - May 2013: Ler heads the Ministry of Health's (MOH) National Public Health Unit and gets access to the HIV Registry.

• End-2012: Ler says he was asked by Dr Jeffrey Cutter - then director of the Communicable Diseases Division at MOH - whether he has taken any screenshots of the HIV Registry, as alleged by Brochez.

• August/ September 2013: MOH launches inquiry into Brochez's allegation that Ler revealed his HIV status to others. It informs the Ministry of Manpower, which threatens to cancel Brochez's PEP.

• Nov 22, 2013: Ler and Brochez fake another blood test. MOH investigator visits clinic and is surprised to learn that Ler, whom he is investigating, conducted the test on Brochez.

• Dec 10, 2013: Ler lies to MOH officer that the person who accused him is not the person whose blood sample he took.

• Dec 11, 2013: Police report lodged over a possible cheating offence over the Nov 22, 2013, blood test.

• Jan 23, 2014: Ler is questioned by the police and lies it was Brochez's blood - not his own - that was tested.

• May 2, 2014: Brochez also tells police that it was his blood that was tested.

• May 2016: MOH lodges police report after learning that Brochez possesses information which appears to be from the HIV Registry.

• May 23-24, 2016: Both Ler and Brochez are questioned by the police and arrested. Many items are seized from their flat.

• June 2016: Ler is charged with offences under the Penal Code and Official Secrets Act (OSA). Brochez is remanded in prison.

• March 2017: Brochez is convicted of numerous fraud and drug-related offences, and sentenced to 28 months in jail.

• April 2018: Brochez is released from prison and deported.

• May 2018: MOH learns that Brochez still has part of the HIV Registry records he had possessed in 2016. This includes details of people with HIV. At the time, the records did not appear to have been disclosed publicly. MOH makes a police report and contacts the affected individuals to notify them.

• September 2018: Ler is convicted of abetting Brochez to commit cheating and of providing false information to the police and MOH. He is sentenced to 24 months in jail.

• Jan 22, 2019: MOH is notified by the police that confidential information from MOH's HIV Registry, that could be in Brochez's possession, has been leaked online.

• Jan 23, 2019: MOH makes a police report.

• Jan 24, 2019: MOH ascertains that the disclosed information matches the HIV Registry's records up to January 2013.

• Jan 24-25, 2019: MOH works with relevant parties to disable access to the information.

• March 2019: Ler's appeal against his 24-month sentence to be heard. His charge under the OSA is pending.

Join ST's WhatsApp Channel and get the latest news and must-reads.

A version of this article appeared in the print edition of The Straits Times on January 31, 2019, with the headline Love, lies, leak: Timeline of HIV Registry data breach. Subscribe