Government and Commercial Data Compromised in LiteLLM Supply Chain Attack and Measures to Prevent Recurrence
Ministry of Digital Development and InformationSpeakers
Summary
This question concerns an inquiry by Mr Gerald Giam Yean Song regarding data compromised in the LiteLLM artificial intelligence supply chain attack, remedial actions taken, and measures to prevent recurrence. Minister Mrs Josephine Teo explained that hackers added malicious code to LiteLLM updates using login details stolen in an earlier breach. She stated that GovTech quickly identified that only one user account supporting a small number of agencies was compromised, with no evidence that any Government or personal data was stolen. Affected agencies promptly changed exposed login credentials and checked system logs, while the Singapore Cyber Emergency Response Team issued an advisory to assist commercial entities. Minister Mrs Josephine Teo noted that while supply chain attack risks cannot be fully eliminated, the Government continuously reviews and improves its prevention, detection, and response measures.
Transcript
31 Mr Gerald Giam Yean Song asked the Minister for Digital Development and Information (a) what types of data owned by the Government or commercial entities in Singapore were compromised in the artificial intelligence (AI) supply chain attack on LiteLLM; (b) what remedial actions were taken to safeguard any personal and Government data lost; and (c) what is being done to prevent a recurrence.
Mrs Josephine Teo: LiteLLM is widely used open-source artificial intelligence (AI) software. Hackers compromised it by using login details stolen in an earlier breach to add malicious code to software updates.
GovTech used scanning and detection tools to identify the affected Government agencies and informed them quickly. The attack was confirmed to have compromised only one user account, which supported a small number of agencies. The affected agencies changed any login details that might have been exposed and checked their system records for signs of unauthorised activity. There is no evidence that any Government data, including personal data held by the Government, was stolen or compromised.
The Government does not have a complete picture of how the incident affected commercial entities. Each company should check its own systems, fix any problems and make any required reports. The Singapore Cyber Emergency Response Team has published an advisory on the incident and can provide cybersecurity guidance and help where needed.
Attacks on software supply chains are an ongoing threat. The risks cannot be removed completely. However, the Government will keep reviewing and improving how it prevents, detects and responds to such attacks, so that similar incidents are less likely and cause less harm.