Doctor Anywhere suffers data breach following 'malicious cyber incident'

Healthcare company Doctor Anywhere has suffered what it described as a "malicious cyber incident" that resulted in the leak of personal data of its users.

In a statement, Doctor Anywhere said the incident involved "unauthorised access by an unknown third party", but stopped short of saying when the incident happened, how many customers were affected, and the type of data compromised. 

It explained that this was because investigations are still ongoing.

“We take information security very seriously and took immediate action to address the incident,” Doctor Anywhere said.

According to its website, Doctor Anywhere has over 3 million users across Southeast Asia, including more than 1,000 corporate accounts.

To rectify the issue, it has engaged cybersecurity services company Ensign InfoSecurity to support its investigation and strengthen its IT systems.

“As of Oct 30, Ensign InfoSecurity has validated the security fixes deployed by our IT team and confirmed that the identified vulnerabilities in our system have been secured,” the company added.

It stated that clinical records were not affected by the incident and that affected users are in the process of being notified.

The breach is said to have also affected clients of Adept Health, a subsidiary of Doctor Anywhere, which works with organisations to administer corporate benefits.

“Our priority remains ensuring business continuity, communicating with the affected stakeholders and implementing further cybersecurity enhancements as part of our ongoing response to the incident.”

Doctor Anywhere has reported the incident to the Personal Data Protection Commission (PDPC) and filed a police report. PDPC is aware and investigating the case.

It added that its services remain available and users can continue receiving treatment at its healthcare facilities.

AsiaOne has reached out to Doctor Anywhere for more information on the extent of the data breach.

[[nid:750409]]

editor@asiaone.com