Singapore Data Breach: M1 and Doctor Anywhere Reveal Customer Data Leaked in Two Separate Attacks

Two of Singapore’s best-known companies told their customers on the same day that hackers had stolen their personal data. Mobile operator M1 and telehealth platform Doctor Anywhere both disclosed data breaches on Friday, 6 November 2026, in two separate incidents that exposed identity details belonging to an unknown number of customers.

Neither company has said how many people were affected. But the type of information taken — including national identity card numbers, dates of birth, home addresses and, in one case, bank account details — makes both breaches serious. Identity details like these can be used for fraud, impersonation and phishing scams long after the original attack.

Here is what happened, what was taken, what is safe, and what customers should do now.

What happened

M1, one of Singapore’s mobile and broadband operators, said it discovered a data breach on 30 October. An attacker had gained access to customer data. The company said it has since contained the breach, and that its services and business operations were not affected at any point.

Doctor Anywhere, a healthcare app that lets patients consult doctors online, said it learned of its own breach on 29 October. It described the incident as a “malicious cyber incident involving unauthorised access by an unknown third party”. The company stressed that 29 October is the date it became aware of the problem, not necessarily the date the attack began.

Both companies went public on the same day, 6 November, but the two incidents are separate. Neither company, and no authority, has said the two attacks are linked.

What data was taken from M1 customers

M1 said the compromised data included:

• Customer names
• NRIC or FIN numbers — the identity card number issued to Singapore citizens and permanent residents (NRIC), and the identification number issued to foreigners living in Singapore (FIN)
• Dates of birth
• Mobile phone numbers
• Email addresses
• Home addresses

That combination is valuable to criminals. A name, identity number, date of birth and address together are often enough to impersonate someone, open accounts in their name, or craft convincing scam messages that look genuine because they contain real personal details.

M1 also said what was not taken. No payment card details, financial or banking information, or customer account access were compromised, the company said. The breach has been contained, and affected customers will be told by email or letter.

In a customer email seen by CNA, M1 apologised for the breach and for the concern it caused. It urged customers to be careful when responding to unexpected calls, messages or emails, and to check the identity of anyone who contacts them through official channels.

What data was taken from Doctor Anywhere users

Doctor Anywhere’s public statement did not list the types of data involved. But in an email sent to affected customers, the company said the compromised information included:

• Names
• Email addresses
• Identity card and passport numbers
• Dates of birth
• Emergency contact details
• Bank account details

The same email said there was no evidence that passwords, login details, payment card details, or photos of identity card documents had been taken.

The company also said that, based on its investigation so far, clinical records were not affected. That matters, because Doctor Anywhere holds medical consultation notes and health histories. The company said those records were not part of the leaked data.

The breach also touched Adept Health, a Doctor Anywhere subsidiary that runs corporate health benefits for other organisations. Selected personal data of members with corporate benefits is held in Doctor Anywhere’s systems, and Adept Health has told the organisations it serves about the incident.

How Doctor Anywhere responded

Doctor Anywhere said it brought in cybersecurity and forensic specialists Ensign InfoSecurity to investigate the incident and strengthen its computer systems. As of 30 October, Ensign had checked the security fixes made by the company’s IT team and confirmed that the weak points found in the system had been secured.

The company reported the incident to Singapore’s Personal Data Protection Commission (PDPC), the government body that enforces the country’s data protection law, and filed a police report. Affected users are being notified directly.

Doctor Anywhere apologised for the concern caused and said its priority was keeping services running, communicating with the people affected, and continuing to improve its cybersecurity. Its services are operating as usual, and patients can still get treatment at its healthcare facilities.

M1, for its part, said it was working closely with the relevant authorities and outside specialists on the investigation. The PDPC said on 6 November that it was aware of the M1 breach and was investigating, according to a report in The Straits Times.

Why this matters

Singapore takes data protection seriously. Under the country’s Personal Data Protection Act, organisations must protect the personal data they hold, and must tell the PDPC and affected people about breaches that are likely to cause serious harm.

But Singapore has seen a run of data breaches in recent months. In July 2026, the Singapore Land Authority reported that personal data belonging to about 70,000 people had been leaked after a government test system was exposed. Now two household-name companies have reported breaches on the same day.

The two cases also show how different parts of a person’s digital life can be exposed at once. A phone company holds your number, address and identity card details. A health app holds your identity documents, emergency contacts and bank details. When both are hit in the same week, the same person can find their details exposed in two places at once.

The timing is also notable. On the same day the two breaches were disclosed, Singapore’s Cyber Security Agency issued an advisory about remotely accessible industrial systems, after attacks on refrigeration systems at supermarkets in France and other European countries. It is a reminder that cyberattacks are hitting organisations of every kind at the same time — from supermarkets to phone companies to health apps.

What customers should do now

If you are an M1 or Doctor Anywhere customer, there are some simple steps worth taking. These will not undo the breach, but they can reduce the risk that your leaked details are used against you.

Read the message from the company. If you receive an email or letter from M1 or Doctor Anywhere about the breach, read it carefully. It will tell you whether your data was involved and what the company is doing about it.

Be suspicious of unexpected contact. This is the warning both companies have given. Scammers use leaked details to make fake calls, texts and emails look real. If someone calls claiming to be from your bank, your phone company or a government agency, do not share passwords, one-time codes or bank details. Hang up and contact the organisation yourself through its official number or website.

Watch your bank accounts. Doctor Anywhere customers were told bank account details were among the data taken. Check your bank statements regularly for transactions you do not recognise, and tell your bank at once if you spot anything unusual.

Change your passwords as a precaution. Doctor Anywhere said there was no evidence passwords were taken, and M1 said account access was not compromised. Even so, changing the password on the affected account — and on any other account where you used the same password — is a sensible precaution. Use a different password for each important account.

Turn on two-factor authentication. Where it is available, switch on two-factor authentication on your email, banking and other important accounts. It means that even if someone gets your password, they still need a second code to get in.

Do not click links in unexpected messages. Phishing messages often arrive as a text or email warning of a problem with your account, with a link to “fix” it. Go to the company’s official website or app yourself instead of clicking the link.

What happens next

Both investigations are still going on. The PDPC is investigating the M1 breach, and Doctor Anywhere says its investigation is continuing. That means more details may emerge in the coming days — including, possibly, how many customers were affected, and how the attackers got in.

Neither company has said how the attackers gained access. Doctor Anywhere has said only that an unknown third party gained unauthorised access, and that the weak points found in its systems have now been secured. M1 has said the breach has been contained and it is working with the authorities and outside specialists.

For customers, the most important thing is to stay alert. Identity data does not expire. An identity card number stolen today can still be misused months or years from now, which is why the advice from both companies is the same: be careful about who you trust with your details, and check anything unexpected through official channels.

Frequently asked questions

Were M1 and Doctor Anywhere hacked in the same attack?

No. The two companies have described the incidents as separate, and neither the companies nor the authorities have said they are linked. They were simply disclosed on the same day, 6 November 2026.

How many customers were affected?

Neither company has said. Both have said they are notifying the customers whose data was involved, but they have not given a number.

Was my medical information leaked?

Doctor Anywhere says that, based on its investigation so far, clinical records were not affected. Medical consultation notes and health histories were not part of the leaked data, according to the company.

Was my money at risk?

M1 said no payment card details, financial or banking information were compromised. Doctor Anywhere said bank account details were among the data taken, but there was no evidence payment card details were taken. If you are a Doctor Anywhere user, check your bank statements for anything unusual.

What is the PDPC?

The Personal Data Protection Commission is Singapore’s data protection regulator. It enforces the Personal Data Protection Act, which sets the rules for how organisations must handle personal data, and it investigates breaches.

Should I change my passwords?

It is a sensible precaution, especially if you used the same password on more than one service. Neither company has reported evidence that passwords were taken, but a fresh, unique password and two-factor authentication will make your accounts harder to break into.

Conclusion

Two data breaches in one day is bad news for Singapore, and worse news for the customers whose personal details were exposed. The information taken — identity numbers, dates of birth, addresses and bank details — is exactly the kind of data criminals use for fraud and impersonation.

Both companies say they have contained the incidents, fixed the weak points in their systems, and told the regulator. Both have apologised. But the details that were taken cannot be taken back, and the real test now is whether customers stay alert to the scams that often follow a breach like this.

If you use M1 or Doctor Anywhere, read the message the company sends you, watch your accounts, and treat any unexpected call or message asking for personal details with suspicion.

Sources

• The Straits Times, “M1 hit by data breach”, 6 November 2026: https://www.straitstimes.com/singapore/m1-hit-by-data-breach
• Goody Feed, “M1 & Doctor Anywhere disclose separate data breaches, customer numbers not revealed”, 7 November 2026: https://goodyfeed.com/m1-doctor-anywhere-disclose-separate-data-breaches-customer-numbers-not-revealed/
• Techgoondu, “Are M1, Doctor Anywhere and others doing enough to help users after a data breach?”, 7 November 2026: https://www.techgoondu.com/2026/11/07/are-m1-doctor-anywhere-and-others-doing-enough-to-help-users-after-a-data-breach/
• news4me.sg, “Doctor Anywhere reports data breach, clinical records safe”, 6 November 2026: https://www.news4me.sg/article/doctor-anywhere-reports-data-breach-clinical-records-safe-86b58eb9e441
• cvetodo, “Singapore threat report”, 2026: https://cvetodo.com/threat-report/sg

This article is for general information and education only. It is not legal or financial advice.