M1 and Doctor Anywhere hit by data breaches; personal information compromised

M1 said no financial or banking information was compromised, while Doctor Anywhere said clinical records were not affected.

Read a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST Tap here to return to FAST
FAST

SINGAPORE: M1 has experienced a data breach affecting customers' personal information, including names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses.

In an email seen by CNA on Friday (Nov 6), M1 said that the data breach occurred on Oct 30 and that no payment card details, financial or banking information, or customer account access had been compromised.

The email urged customers to remain vigilant and exercise caution when responding to unsolicited calls, messages or emails.

"M1 takes the security and confidentiality of information entrusted to us very seriously. We regret that this data breach has occurred and apologise for the concern it has caused you."

M1 is one of two organisations in Singapore to report a data breach on Friday, alongside healthcare provider Doctor Anywhere.

Personal data of Doctor Anywhere users was leaked in a "malicious cyber incident", the healthcare provider said in a statement.

CNA Games

Guess Word
Crack the word, one row at a time

Buzzword
Create words using the given letters

Mini Sudoku
Tiny puzzle, mighty brain teaser

Mini Crossword
Small grid, big challenge

Word Search
Spot as many words as you can
Show More
Show Less

"We take information security very seriously and took immediate action to address the incident," it said.

It did not say when the "unauthorised access by an unknown third party" took place, how many customers were affected and what type of data was compromised.

“As investigations are still ongoing, we are not able to provide any other details about the incident at this stage,” it said in the statement.

It added that it engaged an independent cybersecurity and forensic specialist, Ensign InfoSecurity, to support its investigation and strengthen its IT systems after the incident..

"As of Oct 30 2026, Ensign InfoSecurity has validated the security fixes deployed by our IT team and confirmed that the identified vulnerabilities in our system have been secured. 

"Based on investigation to date, all clinical records are not affected by this incident."  

It has reported the incident to the Singapore Personal Data Protection Commission and filed a police report. Affected users are being notified.

"We sincerely apologise for any concern this incident may cause," it added.

Doctor Anywhere said its subsidiary, Adept Health, which works with other organisations to administer corporate benefits, has informed the organisations it works with about the incident as well. 

"Our priority remains ensuring business continuity, communicating with the affected stakeholders and implementing further cybersecurity enhancements as part of our ongoing response to the incident."  

It added that its services remain operational, and customers can continue receiving treatment at its healthcare facilities.

"We continue to vigilantly monitor the situation and will provide timely updates to our stakeholders affected by the incident."

CNA has reached out to the Personal Data Protection Commission, M1 and Doctor Anywhere for more information.

Sign up for our newsletters

Get our pick of top stories and thought-provoking articles in your inbox

Subscribe here

Get the CNA app

Stay updated with notifications for breaking news and our best stories

Download here

Get WhatsApp alerts

Join our channel for the top reads for the day on your preferred chat app

Join here