On Friday, 6 November, two Singapore companies disclosed separate data breaches. One is the telco M1. The other is Doctor Anywhere, which runs telehealth services and clinics. M1 says an incident on 30 October exposed customer names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and home addresses. It says no payment card, financial or banking details were taken, and that no one gained access to customer accounts. Doctor Anywhere says an "unknown third party" got unauthorised access to a system holding users' personal data. It says clinical records were not affected. Neither company has said how many people are affected. Singapore's data protection regulator, the Personal Data Protection Commission (PDPC), told The Straits Times it is investigating the M1 case. Doctor Anywhere says it has reported its incident to the PDPC and to the police.
What Happened
M1. M1 told customers about the breach by email, which CNA has seen, and in a statement reported by The Straits Times. The telco says the breach happened on 30 October, has been contained, and did not disrupt its services or business operations. M1 says it is "working closely on the ongoing investigations with the relevant authorities and third-party specialists". It will contact affected customers by email or letter. It has not said how the attacker got in, which systems were involved, or how many customers were affected. The Straits Times says it has asked M1 for more detail.
Doctor Anywhere. Doctor Anywhere published a notice, quoted by CNA, Asia One and Cybersecurity ASEAN, calling the incident "a malicious cyber incident involving unauthorised access by an unknown third party to the Doctor Anywhere system containing personal data of our users." The company has not said when the intrusion happened, how many users are affected, or what kinds of data were exposed, because "investigations are still ongoing." It brought in Ensign InfoSecurity as an independent forensic firm. The notice says that as of 30 October, Ensign had "validated the security fixes deployed by our IT team". That was a week before the company went public. According to Berita Mediacorp and Cybersecurity ASEAN, the company says it has notified affected users or is in the process of doing so, has reported the incident to the PDPC and police, and is running its services as normal.
The two breaches were disclosed on the same day, and Doctor Anywhere's fixes were validated on the same date M1 says its breach happened. Neither company has suggested the incidents are linked, and no reporting so far connects them.
What Was Taken
M1: The Straits Times and CNA, both citing M1, list the exposed data as names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses. Cybersecurity ASEAN gives a shorter list (names, identity card details, dates of birth and mobile numbers). This looks like a shortened summary, not a different account. M1 says payment card details, financial and banking information, and account access were not affected. Number of people affected: not disclosed.
Doctor Anywhere: The company says users' personal data was accessed and that "all clinical records are not affected". It has not listed which personal data fields were involved. Cybersecurity ASEAN reports that the people affected include clients of Doctor Anywhere's subsidiary Adept Health, which runs corporate benefits schemes for employers. The company says "selected personal data of members with corporate benefits" is stored in Doctor Anywhere's systems. This means people who never signed up with Doctor Anywhere themselves, but receive health benefits through an employer, may be affected. Number of people affected: not disclosed.
Why It Matters
M1 has confirmed that NRIC/FIN numbers, dates of birth, mobile numbers and home addresses were exposed together. This is exactly the set of details scammers use to pose as banks, telcos and government agencies. Singapore already has a serious scam problem, so this data makes convincing impersonation calls and messages easier, even though no financial data was taken. M1's advice to customers to check callers through official channels shows it expects this follow-on risk.
The Doctor Anywhere case shows that health platforms hold more than clinical records. They also hold identity, contact and employer benefits data, and that data has value of its own. Because corporate benefits data is held there, the breach may reach employees of client companies who have no direct relationship with Doctor Anywhere. Organisations that buy benefits services through Adept Health should ask the company directly whether their staff are affected.
Neither company has given victim counts, attack details or a timeline of when the attackers first got in. Until they do, defenders should assume the exposed data is already circulating.
The Attack Technique
Neither company has said how the attackers got in. M1 has given no technical detail. Doctor Anywhere refers to "unauthorised access" and to "security fixes" that it deployed and Ensign validated, which suggests it closed a specific weakness, but it has not said what that weakness was. No group has publicly claimed either attack, and neither company has mentioned ransomware or extortion.
Recent healthcare incidents show common ways in that are worth checking for, but they are not confirmed causes here. In Japan, MICIN said that on 23 October attackers broke into its Curon online consultation service through credential stuffing, which means logging in with usernames and passwords leaked from other services. The attackers viewed data on 73 patients through clinic accounts. In the Change Healthcare breach, UnitedHealth's CEO told the US Senate that the attackers got in through a remote-access portal that had no multi-factor authentication. The State of Nebraska alleges the login used belonged to a low-level support account. These are examples of common attack paths, and there is no evidence they apply to M1 or Doctor Anywhere.
What Organizations Should Do
- Prepare for impersonation scams that use this data. Telcos, banks and healthcare providers should warn customers that callers who know their NRIC, date of birth and address may still be scammers. Contact centres should not treat knowledge of these details as proof of identity.
- Require multi-factor authentication on every login that can be reached from the internet. This includes customer portals, clinic and partner logins, support tools and remote-access gateways. Leaked or reused passwords remain one of the cheapest ways in.
- Map where data from partners and subsidiaries is stored. Doctor Anywhere holds Adept Health's corporate benefits data in its own systems. Organisations should know which outside parties hold their employees' or customers' data, and require breach notification terms in those contracts.
- Collect less identity data and restrict who can see it. Store full NRIC/FIN numbers only where the law requires it. Mask them in everyday systems, and keep them separate from contact data so that one breach does not expose a full identity profile.
- Watch for large or unusual data exports. Alert on bulk queries, unusual export volumes and data going to new destinations. Data is often taken days before an incident is noticed.
- Affected individuals: Treat unexpected calls, texts and emails that mention M1 or Doctor Anywhere with suspicion. Confirm them through official channels, turn on multi-factor authentication for email and banking, and watch for attempts to take over your SIM card or accounts.
Sources: M1 and Doctor Anywhere hit by data breaches; personal information c... | M1 hit by data breach The Straits Times | Kebocoran data peribadi pelanggan M1, Doctor Anywhere dalam dua ins... | Doctor Anywhere Suffers Data Breach Following 'Malicious Cyber Inci... | How One Stolen Login Exposed Data on 192.7 Million People at Change... | Why Two-Factor Authentication? Lessons from an Online | Medium | Data Breach at Doctor Anywhere Leaks Users' Personal Data, Company...