VULNpocalypse
MediumBreach / campaignMonitoring

M1 and Doctor Anywhere disclose data breaches, Techgoondu reports

Techgoondu reports M1 and Doctor Anywhere disclosed data breaches exposing personal data, and affected users should treat unexpected calls with caution.

Published
Exploitation
Not confirmed, the source does not link any confirmed misuse of the data to these incidents

What happened

Techgoondu reports that Singapore telecom operator M1 and remote medical service Doctor Anywhere have each disclosed a data breach (Techgoondu). The article is an opinion piece by Alfred Siew. It relays the companies’ statements and does not include independent verification.

According to Techgoondu, M1 said a data breach on October 30 exposed these customer details:

  • names
  • NRIC or FIN numbers
  • dates of birth
  • mobile numbers
  • e-mail addresses
  • residential addresses

M1 also said no financial or banking information was compromised, and that the attackers could not access customer accounts (Techgoondu).

Doctor Anywhere said a “malicious cyber incident” involving “unauthorised access by an unknown third party” leaked its users’ personal data, Techgoondu reports. Doctor Anywhere did not detail what information was exposed. It said clinical records were not affected (Techgoondu).

The article also cites an earlier incident. The Singapore Land Authority (SLA) reported a leak of personal data affecting 70,000 people about four months before (Techgoondu).

The following details are not confirmed in the source:

  • the number of people affected at M1 or Doctor Anywhere
  • how the attackers got in
  • who is responsible
  • whether this specific data has been sold or misused

Am I affected?

  • M1: You may be affected if you are or were an M1 customer. The author says he received an M1 notice as a former mobile and broadband customer (Techgoondu).
  • Doctor Anywhere: Users may be affected, but the exposed data types are not confirmed.
  • Developers and organisations: No software, versions or CVEs are involved.

What to do now

  1. Check for a breach notice from M1 or Doctor Anywhere. According to Techgoondu, M1 has sent notices to affected people (Techgoondu).
  2. Treat callers who read out your name, NRIC and address as unverified. The author describes scammers posing as a bank and quoting exactly these details (Techgoondu).
  3. Assume basic personal information of the kind leaked at M1 may already be available to scammers, as the article advises (Techgoondu).
  4. As a general precaution, not from the source: if you get such a call, hang up and contact the bank or company through a number you look up yourself.

Sources