They say they were notified on 22 January this year that Farrera-Brochez could still have possession of the HIV registry data.
Confidential data containing the HIV-positive status of thousands of individuals living in Singapore was recently leaked online by United States citizen Mikhy Brochez, Singapore's Health Ministry announced on Monday.
According to the Straits Times, a Singaporean newspaper, Brochez submitted a blood sample from Ler as his own, after testing positive for HIV in 2008.
The group also called on Singaporeans to "deny power to this vicious act" of data leak by standing in solidarity with HIV-positive individuals and their families.
He was convicted of fraud and drug-related offences in March 2017, and was deported from Singapore after completing his sentence.
The latest data spill comes less than a year after a cyber attack on SingHealth that had exposed the medical data of about 1.5 million people, including outpatient details of the Singapore Prime Minister Lee Hsien Loong. His partner previously had access to the HIV registry for his work, the ministry said.
While it made no public announcement at the time, the MoH said it notified the individuals involved.
However, the information is still in the hands of Farrera-Brochez, who was deported after he had served his jail term.
In addition, MOH said Ler has been charged under the OSA for failing to take reasonable care of confidential information regarding HIV-positive patients.
He apparently took information from the HIV registry with him, which he had illegally obtained from his partner, a Singaporean doctor who was head of Singapore's National Public Health Unit. A workstation specifically configured and locked down to prevent unauthorised information removal was designated for the processing of sensitive information from the HIV Registry.
"We are sorry for the anxiety and distress caused by this incident", said the ministry in a statement.
The ministry said it has put more safeguards in place to prevent information from being mishandled.
While the availability of the data online has been disabled, there is a risk that it can still be publicly disclosed in the future as it is allegedly still in Farrera-Brochez's possession.
Authorities said they learned in 2016 Brochez possessed the sensitive information and raided his residence where they believed all the information had been retrieved. Officials said his whereabouts are unknown. Ler has since been convicted of abetting Farrera-Brochez to commit cheating and of providing false information to the police and MOH.
The MOH discovered that Brochez had the confidential records in 2016 and reported this to police, which searched his and Ler's properties and seized all relevant material. Ler was sentenced to 24 months in jail, but has since filed an appeal, which is expected to be heard in March.