Doctor Anywhere confirms breach exposing bank details and ID numbers

Doctor Anywhere confirmed that an unknown third party gained unauthorized access to user data in a malicious cyber incident. The company said it became aware of the incident on Oct. 29, 2026. Doctor Anywhere released its public statement on the evening of Nov. 6, 2026.

The compromised information included bank account details, emergency contact details, dates of birth, identity card and passport numbers, e-mail addresses and names, the company said. Doctor Anywhere said it found no evidence that images of identity documents, payment card details, login credentials or passwords were taken. Clinical records were not affected based on its investigation to date.

The company has not disclosed when the unauthorized access started, how many users were affected, or the complete technical method used by attackers. Doctor Anywhere said it has not released a public count of affected users or a date for when the unauthorized access began while the investigation continues. Doctor Anywhere said ongoing investigations mean it cannot share further details about the incident at this point.

Doctor Anywhere hired Ensign InfoSecurity to help investigate the incident and improve its IT systems. As of Oct. 30, 2026, Ensign confirmed that security fixes put in place by the company’s IT team had closed the identified vulnerabilities. The company told Singapore’s Personal Data Protection Commission about the breach and also made a police report.

Doctor Anywhere is notifying affected users, including clients of Adept Health, a subsidiary that handles corporate benefits for other organizations. The company keeps selected personal data of corporate-benefits members in its systems to administer those benefits. Its services remain operational and patients can continue receiving treatment at its healthcare facilities.

According to its website, Doctor Anywhere serves more than three million users in South-east Asia and more than 1,000 corporate accounts.

The Personal Data Protection Commission said it is aware of the Doctor Anywhere case and is investigating. The Straits Times saw an email sent to affected customers. Doctor Anywhere said it was sorry for the concern caused and promised to keep improving cybersecurity and updating affected stakeholders.

Doctor Anywhere said, “We continue to vigilantly monitor the situation and will provide timely updates to our stakeholders affected by the incident.”