Important Notice Regarding a Cyber Incident

What happened?

We recently became aware of a malicious cyber incident involving unauthorised access by an unknown third party to the Doctor Anywhere system containing personal data of our users. We take information security very seriously and took immediate action to address the incident.

Based on investigation to date, all clinical records are not affected by this incident.

We sincerely apologise for any concern this incident may cause.

Has the issue been resolved?

Upon discovery of the potential unauthorised access, we acted immediately to contain the incident and engaged Ensign InfoSecurity (Singapore) Pte. Ltd., (“Ensign InfoSecurity”) an independent cybersecurity and forensic specialist to support a formal investigation and further strengthen our IT systems. As of 30 October 2026, Ensign InfoSecurity has validated the security fixes deployed by our IT team and confirmed that the identified vulnerabilities in our system have been secured. Investigations are ongoing, and we will provide further updates where appropriate.

We have reported the incident to the Singapore Personal Data Protection Commission, made a police report, and have engaged, and will continue to engage, in discussions with the relevant authorities and the Singapore Police Force. We remain committed to cooperating with all relevant authorities to support their investigations. We are in the process of notifying the relevant clients and partners impacted by the incident. The affected users are in the process of being notified by us and/or our clients and partners.

Am I affected?

If your personal data was affected, you would have received / will receive a notification.

For individuals who have received a notification from an organisation other than DA: Why was I informed by another company and not DA?

Adept Health Pte. Ltd. (a member of the Doctor Anywhere Group) is a third-party administrator that works with other organisations to administer corporate benefits. As part of the services we provide on behalf of other organisations, certain personal data relating to their members and/or employees is maintained in our systems to facilitate the administration of corporate benefits.

We have informed these organisations and we understand that they have informed you if your personal data was affected by the incident.

Can I continue to use DA?

Our priority remains ensuring business continuity, communicating with the affected stakeholders and implementing further cybersecurity enhancements as part of our ongoing response to the incident. We continue to deliver services to our clients and patients. All of our services continue to operate as usual. Customers can continue to access and receive medical treatment at our healthcare facilities.

What can I do now?

We recommend taking these steps as a precaution:

• Be alert to suspicious calls, emails or SMS messages. Be particularly cautious of anyone claiming to represent an organisation you deal with, a healthcare provider, a bank or a government agency.
• Never disclose passwords, Singpass or other account credentials;
• Do not provide banking information (such as bank account number) to anyone except trusted parties.
• Avoid clicking on suspicious links or downloading unfamiliar attachments, even if the message appears to come from a familiar organisation.
• Monitor your financial accounts and other important accounts for any unusual or unauthorised activity.
• Before responding to any unexpected requests, verify the request independently by separately contacting the organisation through its official website or published telephone number.

How do I know if a message is really from DA?