Authorities in Singapore say the HIV-positive status of 14,200 people has been posted online.

The status and contact info of 5,400 Singaporeans diagnosed before January 2013 and 8,800 foreigners diagnosed before December 2011 were disclosed in the breach.

The country’s ministry of health says a disgruntled American, Mikhy K Farrera Brochez, was the source of the leak.

Brochez was deported from Singapore last May after serving 28 months in jail for “numerous fraud and drug-related offenses.”

Ler Teck Siang, a doctor and Brochez’s partner, supposedly helped Brochez falsify his own HIV-positive status so that he could join him in Singapore, which doesn’t allow foreigners with HIV to gain permanent residence or employment visas. Ler is also accused of giving Brochez access to the HIV Registry.

The ministry of health said it was aware Brochez had the records back in 2016, but when his and Ler’s property was searched, they thought “all relevant material found were seized and secured by the police.”

After Brochez’s deportation, they realized he still had some of the registry, and claim to have notified people who would be impacted, but that no leak occurred until recently.

And apparently, there’s still more information he could put out.

“While access to the confidential information has been disabled, it is still in the possession of the unauthorized person, and could still be publicly disclosed in the future,” the ministry said. “We are working with relevant parties to scan the internet for signs of further disclosure of the information.”

There is still a strong stigma surrounding gay people in Singapore, and sex between two men is technically illegal, though the law is not strongly enforced.