Data Breach at Doctor Anywhere Leaks Users' Personal Data, Company Says Clinical Records Were Not Affected

Doctor Anywhere, the Singapore telehealth and clinic operator, said on the evening of 6 November that users' personal data had leaked in "a malicious cyber incident involving unauthorised access by an unknown third party". The company says "all clinical records are not affected by this incident". It hasn't said when the intrusion happened or how many people are affected, and it hasn't listed the kinds of personal data involved.

Who is being notified

Doctor Anywhere says affected users are "in the process of being notified". They include clients of its subsidiary Adept Health, which administers corporate benefits for other organisations; the company explains that "selected personal data of members with corporate benefits" sits in Doctor Anywhere's own systems. The statement gives users no specific steps to take.

Investigation and fixes

Ensign InfoSecurity was brought in as an independent forensic specialist, and by 30 October it had "validated the security fixes deployed by our IT team", a week before the company went public. Doctor Anywhere has reported the incident to the Personal Data Protection Commission and filed a police report. Its services are running as usual.

M1 disclosed a breach the same day

Also on 6 November, the telco M1 said it suffered a breach on 30 October that exposed customer names, identity card details, dates of birth and mobile numbers, in a Straits Times report carried by Yahoo News. M1 didn't say how many customers were affected, though it says the breach has since been contained. The Personal Data Protection Commission is investigating that case too.