{
  "id": "doctor-anywhere-adept-data",
  "url": "https://ohshit.app/incidents/doctor-anywhere-adept-data/",
  "title": "Doctor Anywhere and Adept Health incident exposes personal data, including possible insurance and bank details",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-06",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Doctor Anywhere",
    "Adept Health",
    "Data breach"
  ],
  "ecosystems": [],
  "summary": "Income Insurance confirms an Adept Health/Doctor Anywhere system incident and lists possible identity, contact, policy and bank-account data. It reports no evidence of medical-record access or compromise of its own systems. Doctor Anywhere says fixes were validated and services continue; total scope remains under investigation.",
  "splash": "Doctor Anywhere users and corporate-benefit members whose data was held in the affected system, including relevant Income customers.",
  "wipe": "Verify your exposure with your benefits administrator or insurer, watch bank activity and reject credential or QR-code lures.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Ask which of your benefits records were involved",
      "hint": "Use your established insurer, employer benefits administrator or Doctor Anywhere support channel. Income’s possible list includes full name, email, phone, NRIC/FIN/passport number, address, birth date, gender, nationality, race, emergency contacts, policy details and bank name/account number. This is its administrator-reported possible scope, not a universal field list for all Doctor Anywhere users."
    },
    {
      "title": "Watch banking and policy-related impersonation",
      "hint": "Monitor bank accounts and contact the bank immediately over suspicious activity. Avoid unexpected links, attachments and QR codes; never disclose passwords or one-time codes to a purported insurer or benefits administrator. Income directs suspected policy impersonation to 6788 1777 and scams to 1799 or ScamShield; verify these through its official site."
    },
    {
      "title": "Follow direct notices without assuming medical records were stolen",
      "hint": "Keep your notice and ask about your specific records. Income reports no evidence of medical-record access or its own system compromise, while Doctor Anywhere says clinical records were unaffected and services remain operational. These are investigation-stage assessments, not an independent guarantee. No public customer patch or blanket password reset is specified."
    }
  ],
  "sources": [
    {
      "name": "Income Insurance original Adept Health incident advisory",
      "url": "https://www.income.com.sg/about-us/corporate-information/advisory/adept-health-cyber-incident",
      "says": "November 6 notice confirms November 2 notification, possible personal/policy/bank fields, exclusions, ongoing investigation and concrete customer precautions.",
      "primary": true
    },
    {
      "name": "CNA reporting of Doctor Anywhere’s statement",
      "url": "https://www.channelnewsasia.com/singapore/doctor-anywhere-data-breach-6530871",
      "says": "Reports Ensign validation as of October 30, ongoing notification/investigation, clinical-record exclusion and continued services; no total customer count or universal field list.",
      "primary": false
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Income confirms its administrator reported unauthorized Doctor Anywhere system access.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Oct 30, 2026",
      "title": "Doctor Anywhere says identified fixes have been independently validated",
      "body": "CNA reports the company’s statement that Ensign InfoSecurity validated deployed fixes by this date; this is not the public-disclosure date or a final scope finding."
    },
    {
      "date": "Nov 2, 2026",
      "title": "Adept Health informs Income Insurance",
      "body": "Income activates incident response and informs authorities, according to its later original notice."
    },
    {
      "date": "Nov 6, 2026",
      "title": "Public disclosure and affected-customer notification",
      "body": "Income lists possible fields and ongoing investigation. Doctor Anywhere reports notifications, a police/PDPC report and continued healthcare services."
    }
  ],
  "body_markdown": "The primary notice concerns a third-party administrator’s Doctor Anywhere system, and does not establish a breach of Income’s own infrastructure. Its possible fields should not be generalized to all patients or policyholders. No victim count, intrusion mechanism or confirmed fraud total is published. L4 reflects confirmed unauthorized access involving sensitive personal records, with final scope unresolved."
}