Doctor Anywhere and Adept Health incident exposes personal data, including possible insurance and bank details
Income Insurance confirms an Adept Health/Doctor Anywhere system incident and lists possible identity, contact, policy and bank-account data. It reports no evidence of medical-record access or compromise of its own systems. Doctor Anywhere says fixes were validated and services continue; total scope remains under investigation.
- Disclosed
- Nov 6, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Doctor Anywhere users and corporate-benefit members whose data was held in the affected system, including relevant Income customers.
- Doctor Anywhere · Adept Health · Data breach
- In the wild
- Yes
- Income confirms its administrator reported unauthorized Doctor Anywhere system access.
What happened
The primary notice concerns a third-party administrator’s Doctor Anywhere system, and does not establish a breach of Income’s own infrastructure. Its possible fields should not be generalized to all patients or policyholders. No victim count, intrusion mechanism or confirmed fraud total is published. L4 reflects confirmed unauthorized access involving sensitive personal records, with final scope unresolved.
Crime-scene timeline
Oct 30, 2026
Doctor Anywhere says identified fixes have been independently validated
CNA reports the company’s statement that Ensign InfoSecurity validated deployed fixes by this date; this is not the public-disclosure date or a final scope finding.
Nov 2, 2026
Adept Health informs Income Insurance
Income activates incident response and informs authorities, according to its later original notice.
Nov 6, 2026
Public disclosure and affected-customer notification
Income lists possible fields and ongoing investigation. Doctor Anywhere reports notifications, a police/PDPC report and continued healthcare services.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Income Insurance original Adept Health incident advisoryPrimaryNovember 6 notice confirms November 2 notification, possible personal/policy/bank fields, exclusions, ongoing investigation and concrete customer precautions.
- CNA reporting of Doctor Anywhere’s statementReports Ensign validation as of October 30, ongoing notification/investigation, clinical-record exclusion and continued services; no total customer count or universal field list.