TLDR;
- Doctor Anywhere, a Singapore healthcare company, disclosed a “malicious cyber incident” involving unauthorised access by an unknown third party.
- Adept Health, its corporate benefits subsidiary, notified Income Insurance on November 2, 2026. Income says customer data may be involved.
- Income lists contact details, NRIC/FIN or passport number, address, policy details and bank account number as potentially involved. It reports no evidence of medical records being accessed.
- The number of affected people has not been disclosed, and the investigation is ongoing.
Doctor Anywhere is a Singapore healthcare company that reports over three million users across Southeast Asia. Adept Health Pte. Ltd. is its subsidiary that administers corporate benefits for organisations.
The company announced the incident in a statement that AsiaOne reported on November 6, 2026. Income Insurance published its own advisory the same day, after Adept Health notified it on November 2, 2026. Doctor Anywhere says clinical records were not affected, and Singapore’s Personal Data Protection Commission (PDPC) is investigating.
Status as of November 10, 2026: the investigation is ongoing, and no count of affected people has been published.
What Happened
In a statement reported by AsiaOne, Doctor Anywhere said that an unknown third party gained unauthorised access, which led to a leak of users’ personal data. Income Insurance describes the same event as unauthorised access to Adept Health’s Doctor Anywhere system. The sources reviewed do not state the incident start date, the method of access, or the volume of data.
- October 30, 2026: Doctor Anywhere says Ensign InfoSecurity had validated its security fixes by this date (as reported by AsiaOne).
- November 2, 2026: Adept Health notified Income Insurance of the incident (Income advisory).
- November 6, 2026: Income Insurance published its advisory, and AsiaOne reported the Doctor Anywhere statement.
- November 7, 2026: Malay Mail republished the AsiaOne report.
- No attacker claim or attribution appears in the sources reviewed.
Impact
Neither organisation has published a figure for affected people. The list of data below comes from Income Insurance and covers its customers. Doctor Anywhere has not published a data list.
- Income lists these data as potentially involved: full name, email address, phone number, NRIC/FIN or passport number, residential address, date of birth, gender, nationality, race, emergency contact details, policy details, bank name and bank account number.
- Income reports no current evidence of medical records being accessed, and Doctor Anywhere says clinical records were not affected.
- The three million figure describes Doctor Anywhere’s total user base. The affected count is undisclosed.
- Income states there is no indication that its own systems were compromised.
- Doctor Anywhere says its services remain available and patients can continue treatment.
Recommended Actions
Income Insurance lists the steps below for its customers. Because NRIC/FIN, address and bank account details are listed as potentially involved, scam attempts that quote personal or policy details are a possible follow-on risk.
For affected individuals (Income Insurance guidance):
- Do not click links or open attachments in unexpected emails or messages claiming to be from Income Insurance.
- Do not share personal information, passwords or one-time passwords unless you are sure who is asking.
- Monitor your bank accounts and contact your bank immediately if you notice anything suspicious.
- Report scam attempts to the National Anti-Scam Hotline (1799) or the ScamShield app, and contact Income at 6788 1777 if someone may be misusing your policy information.
- General guidance: if you use a Doctor Anywhere account, change its password and any password you reuse elsewhere.
For organisations that use Adept Health or Doctor Anywhere (general guidance):
- Ask the vendor which member or employee data was involved.
- Review your own notification obligations with your data protection officer.
- Brief HR and the helpdesk on likely phishing that references the incident.
References: Income Insurance advisory (November 6, 2026), AsiaOne, Malay Mail
