M1 and Doctor Anywhere disclosed separate data breaches on 6 November 2026, with customers’ personal information exposed in both incidents.
M1’s affected data included names, NRIC or FIN numbers, dates of birth, mobile numbers, email addresses and residential addresses. Doctor Anywhere said clinical records were unaffected based on its investigation so far.
Neither company disclosed how many customers were affected in the public reports reviewed as at early 7 November.
M1 Says Breach Contained, Services Unaffected
M1 told 8world that it discovered the breach on 30 October and had since contained it. The telco said it was working with the relevant authorities and external specialists on investigations.
It said payment card details, financial and banking information, and access to customer accounts had not been compromised. Its services and business operations remained unaffected throughout the incident.
Affected customers will be notified by email or letter.
M1 also apologised in a customer email seen by CNA, expressing regret over the breach and the concern it had caused.
The telco urged customers to be cautious when responding to unsolicited calls, messages or emails, and to verify the identity of anyone contacting them through official channels.
The Personal Data Protection Commission said on 6 November that it was aware of M1’s breach and was investigating, The Straits Times reported in an article carried by The Business Times.
Doctor Anywhere Says Clinical Records Unaffected
Doctor Anywhere described its separate breach as a “malicious cyber incident” involving an unknown third party gaining unauthorised access, in a statement reported by CNA.
Its statement did not specify when the incident happened or which types of personal data were compromised, saying investigations were ongoing.
The healthcare provider engaged Ensign InfoSecurity, a cybersecurity and digital forensics specialist, to help investigate and strengthen its IT systems.
Doctor Anywhere said that, as at 30 October, Ensign had checked the security fixes implemented by its IT team and confirmed that the identified system vulnerabilities had been secured.
It reported the incident to the Personal Data Protection Commission and filed a police report. Affected users were being notified.
Its subsidiary Adept Health, which helps organisations administer corporate benefits, had also informed the organisations it works with.
Doctor Anywhere apologised for the concern caused and said it would continue strengthening cybersecurity and updating affected stakeholders.
Its services remained operational, and customers could continue receiving medical treatment at its healthcare facilities.
