Doctor Anywhere Data Breach Singapore: Passport Numbers and Bank Details Leaked — What Users Should Do
Image: Wikimedia Commons / Shixart1985, CC BY 2.0 (illustrative image)
TL;DR: Doctor Anywhere data breach in Singapore: personal data of users of the telehealth provider has leaked after unauthorised access by an unknown third party. Leaked data includes names, email addresses, identity card and passport numbers, dates of birth, emergency contact details and bank account details. No affected-customer count has been disclosed, clinical records were not affected, and the company says its services are operating as usual.
📌 Key Highlights
- Doctor Anywhere confirmed on the evening of 6 November 2026 that user personal data leaked in a "malicious cyber incident" involving unauthorised access.
- Compromised data includes identity card and passport numbers, dates of birth, emergency contact details and bank account details — plus names and email addresses.
- The company knew about the breach on 29 October; forensic firm Ensign InfoSecurity validated the security fixes on 30 October and the vulnerabilities are secured.
- No evidence that passwords, login credentials, payment card details or images of identity documents were compromised; clinical records were not affected.
- The company has not said how many customers were affected. It has reported the breach to Singapore's Personal Data Protection Commission and made a police report.
What happened in the Doctor Anywhere data breach?
Doctor Anywhere, a Singapore telehealth provider, said in a statement on the evening of Friday, 6 November 2026 that personal data of its users had been leaked in a data breach. The company described it as "a malicious cyber incident involving unauthorised access by an unknown third party". In an email sent to affected customers and seen by The Straits Times, the company said it knew about the data breach on 29 October.
The company engaged cybersecurity and forensic specialist Ensign InfoSecurity to support its investigation. "As of Oct 30, Ensign InfoSecurity has validated the security fixes deployed by our IT team and confirmed that the identified vulnerabilities in our system have been secured," Doctor Anywhere said. Based on its investigation so far, all clinical records were not affected. Affected users are being notified, including clients of Adept Health, a subsidiary that administers corporate benefits. The company has reported the breach to the Personal Data Protection Commission (PDPC) and made a police report, and says its services are operating as usual.
What data was leaked?
The customer notification email seen by The Straits Times lists the types of personal data compromised. The company has not said how many customers were affected, and not every affected user will necessarily have had every data type exposed.
| Data type | Status |
|---|---|
| Name, email address | Compromised |
| Identity card and passport numbers | Compromised |
| Date of birth, emergency contact details | Compromised |
| Bank account details | Compromised |
| Passwords, login credentials | No evidence of compromise |
| Payment card details, images of identity documents | No evidence of compromise |
| Clinical / medical records | Not affected |
Image: Wikimedia Commons / Microbiz Mag, CC BY 2.0 (illustrative image)
Why it matters for Singapore readers
Doctor Anywhere is one of Singapore's best-known telehealth platforms, with over 3 million users across South-east Asia and more than 1,000 corporate accounts, according to the company's website. The combination of leaked data is what makes this breach serious: identity card and passport numbers plus dates of birth and bank account details are exactly the ingredients used for identity theft and financial fraud, even though payment card details themselves were not compromised.
It is also the second major Singapore breach disclosed on the same day. Local telco M1 said on 6 November that it suffered a data breach on 30 October, exposing customer names, identity card details, dates of birth, mobile numbers, email addresses and addresses — though M1 said no payment card, financial or banking information was compromised. The PDPC said it is aware of the M1 incident and investigating.
Should you care?
✅ Yes — if you use Doctor Anywhere, act on it. Passport numbers and bank account details cannot be changed as easily as a password, so the risk outlives the breach itself. If you received the notification email, follow the steps below now. If you did not, stay alert for phishing messages pretending to be from Doctor Anywhere, your bank or the authorities — breaches like this are routinely followed by scam attempts using the leaked details.
What to do if you use Doctor Anywhere
First, check your email — including spam — for a notification from Doctor Anywhere and read exactly which of your details were affected. Second, watch your bank account for unfamiliar transactions and tell your bank immediately if you spot any. Third, be suspicious of any unexpected call, SMS or email that quotes your personal details to prove it is genuine — scammers now have those details, so a message knowing your name and date of birth proves nothing. Fourth, do not change your Doctor Anywhere password unless the company asks you to — there is no evidence passwords were compromised — but do not reuse that password anywhere else. If you are a corporate-benefits user through Adept Health, check with your employer's HR or benefits team for guidance.
FAQs
How many Doctor Anywhere customers were affected by the data breach?
Doctor Anywhere has not said how many customers were affected. The company said the affected users are in the process of being notified, including clients of its Adept Health subsidiary. We will update this post if a number is disclosed.
Were my medical records leaked in the Doctor Anywhere breach?
Based on the company's investigation so far, all clinical records were not affected by the incident. The leaked data is personal and identity information — names, contact details, identity and passport numbers, dates of birth, emergency contacts and bank account details — not medical records.
Was my bank account or payment card compromised?
Bank account details were among the compromised data, so check your account for unfamiliar transactions and contact your bank if you see any. There is no evidence that payment card details, passwords or login credentials were compromised, according to the company's notification email.
When did the Doctor Anywhere breach happen?
Doctor Anywhere said it knew about the breach on 29 October 2026. Ensign InfoSecurity validated the security fixes on 30 October, and the company disclosed the breach publicly on the evening of 6 November. It has reported the incident to Singapore's Personal Data Protection Commission and made a police report.
Takeaway
The Doctor Anywhere breach exposed identity documents and bank details of an undisclosed number of users — data that stays useful to criminals long after the incident is fixed. The company contained the intrusion within a day and says clinical records are safe, but affected users should monitor their bank accounts and treat any message quoting their personal details with suspicion.
If you use Doctor Anywhere, check your inbox for its notification email — it tells you exactly which of your details were affected. Our M1 data breach explainer covers the other Singapore breach disclosed the same day, and our SBI customer data leak guide explains the same protection steps for bank customers.
Comments
Post a Comment