Doctor Anywhere hit by data breach due to ‘malicious cyber incident’ involving unknown third party

[SINGAPORE] Personal data of users of telemedicine provider Doctor Anywhere has been leaked in a data breach, the group said in a statement on the evening of Friday (Nov 6).

It said the data breach was the result of “a malicious cyber incident involving unauthorised access by an unknown third party”, but did not say how many customers were affected.

In an e-mail sent to affected customers and seen by The Straits Times, Doctor Anywhere said it knew about the data breach on Oct 29.

The types of personal data compromised included name, e-mail address, identity card and passport numbers, date of birth, emergency contact details and bank account details.

Based on its current investigations, there is no evidence to suggest passwords, login credentials, payment card details and images of identity card documents were compromised, Doctor Anywhere said in the e-mail.

It said in its media statement that it engaged cybersecurity and forensic specialist Ensign InfoSecurity to support its investigation and strengthen its IT systems after the incident.

THE BUSINESS TIMES INSIGHTS

Powering Asean's Future 2026

Find out how enterprises are navigating power constraints and sustainability targets

ACCESS THE INSIGHTS

“As of Oct 30, Ensign InfoSecurity has validated the security fixes deployed by our IT team and confirmed that the identified vulnerabilities in our system have been secured,” it said.

“Based on investigation to date, all clinical records are not affected by this incident.”

The affected users are in the process of being notified, Doctor Anywhere said, including clients of Adept Health, a subsidiary that works with other organisations to administer corporate benefits.

SEE ALSO

Doctor Anywhere lays off 8.1% of workforce across Singapore and South-east Asia

Doctor Anywhere grows revenue 58%, narrows losses in 2023

Selected personal data of members with corporate benefits is maintained in Doctor Anywhere’s systems to facilitate the administration of corporate benefits.

The group added that it has reported the data breach to the Personal Data Protection Commission and made a police report.

It said: “We sincerely apologise for any concern this incident may cause. Our priority remains ensuring business continuity, communicating with the affected stakeholders and implementing further cybersecurity enhancements as part of our ongoing response to the incident.”

It added that its services are operating as usual and customers can continue to access and receive medical treatment at its healthcare facilities. THE STRAITS TIMES