---
title: Doctor Anywhere / Adept Health: unauthorized access hit corporate-benefits PII (IDs, bank details); Income Insurance notifies policyholders | ctxsec
url: https://ctxsec.com/items/doctor-anywhere-adept-health-income-insurance-cyber-incident-nov-6
description: "Singapore telehealth provider Doctor Anywhere disclosed a malicious cyber incident with unauthorized access by an unknown third party. Its subsidiary Adept Health, which administers corporate healthcare benefits, informed partners including Income Insurance. Income's Nov 6 advisory says it was told on Nov 2; personal data that may be involved includes full name, email, phone, NRIC/FIN or passport number, address, DOB, gender, nationality, race, emergency contacts, policy details and bank account details. Income and Doctor Anywhere both say there is currently no evidence medical/clinical records were accessed, and Income says its own systems were not compromised. Doctor Anywhere engaged Ensign InfoSecurity, reported to PDPC and police, and says identified vulnerabilities were secured as of Oct 30."
status: "official (Income Insurance advisory Nov 6; Doctor Anywhere / Adept Health statements reported Nov 6); clinical records not shown accessed; investigations ongoing"
published: 2026-11-06
---

> Singapore telehealth provider Doctor Anywhere disclosed a malicious cyber incident with unauthorized access by an unknown third party. Its subsidiary Adept Health, which administers corporate healthcare benefits, informed partners including Income Insurance. Income's Nov 6 advisory says it was told on Nov 2; personal data that may be involved includes full name, email, phone, NRIC/FIN or passport number, address, DOB, gender, nationality, race, emergency contacts, policy details and bank account details. Income and Doctor Anywhere both say there is currently no evidence medical/clinical records were accessed, and Income says its own systems were not compromised. Doctor Anywhere engaged Ensign InfoSecurity, reported to PDPC and police, and says identified vulnerabilities were secured as of Oct 30.

[← Cybersecurity News](/news) · [markdown](/items/doctor-anywhere-adept-health-income-insurance-cyber-incident-nov-6.md)

official (Income Insurance advisory Nov 6; Doctor Anywhere / Adept Health statements reported Nov 6); clinical records not shown accessed; investigations ongoing

2026-11-06

### Doctor Anywhere / Adept Health: unauthorized access hit corporate-benefits PII (IDs, bank details); Income Insurance notifies policyholders

- **Scope caveat:** neither Income nor Doctor Anywhere has published a total affected-person count in the statements we checked.
- **Not claimed exposed (per customer emails reported by Straits Times / company lines):** passwords, login credentials, payment cards, ID-document images.
- **Defender takeaway:** third-party benefits administrators that mirror employee identity + bank fields are high-value IdP-adjacent targets — inventory who holds your staff NRIC/bank data outside HRIS.

Sources: [Income Insurance: Adept Health Cyber Incident (Nov 6)](https://www.income.com.sg/about-us/corporate-information/advisory/adept-health-cyber-incident) · [CNA: M1 and Doctor Anywhere hit by data breaches (Nov 6)](https://www.channelnewsasia.com/singapore/doctor-anywhere-data-breach-6530871) · [The Straits Times: Doctor Anywhere hit by data breach (Nov 6)](https://www.straitstimes.com/singapore/doctor-anywhere-hit-by-data-breach)