November 6, 2026: Doctor Anywhere said a malicious cyber incident let an unknown third party take personal data of users. A customer email seen by The Straits Times lists names, emails, identity-card and passport numbers, dates of birth, emergency-contact details and bank-account details. The company says clinical records are not affected. The catalog entry has no published headcount.
What is known
- Doctor Anywhere says it learned of the breach on 29 October 2026. Ensign InfoSecurity validated security fixes by 30 October.
- The public statement did not list fields or a count. The customer email, as reported by ST, lists the identity and bank fields above and says there is no evidence passwords, login credentials, payment cards or images of ID documents were taken.
- Adept Health, a subsidiary that administers corporate benefits, told client organisations. Income Insurance's advisory (notified 2 November) lists a similar set, including NRIC/FIN or passport, address, gender, nationality, race, policy details, and bank name and account number, and says there is no evidence medical records were accessed and no indication Income's own systems were hit.
- The incident was reported to PDPC and the police. Clinics remain open.
What is not known
- How many users, corporate-benefit members, or Adept Health client staff are in the file.
- The intrusion path, and whether a copy has been offered for sale.
- Whether every field in the Income Insurance list applies to every Doctor Anywhere consumer user, or only to some corporate-benefit records.
The public statement and the customer email do not match in detail. Prefer the email for field types; prefer the statement for the clinical-records finding. Neither is a census.
Who is at risk
Doctor Anywhere app and clinic users who received a notice, and members whose corporate benefits run through Adept Health — including some Income Insurance policyholders. Bank-account numbers plus NRIC are enough for targeted payment and impersonation fraud even without medical notes.
What to do
- Read the Doctor Anywhere or Adept Health notice. Do not send NRIC, OTP or bank details to anyone who calls about "your breach letter."
- Watch the bank account named in the notice. Turn on transaction alerts. If a number you do not recognise appears, call the bank on the number on the card.
- Use Singpass and the official Doctor Anywhere app only — not links in mail.
- Tell emergency contacts they may be phished using their real names.
- Clinics are still running; keep appointments unless the company tells you otherwise. A fake "re-register your medical file" page is the likely follow-on scam.
Sources
- CNA, November 6, 2026
- The Straits Times, November 6, 2026
- Income Insurance, Adept Health advisory, November 6, 2026
Sourcing note: clinical-records language is from Doctor Anywhere. Field lists are from the ST-reported customer email and from Income Insurance. No official count at indexing.