25 OCT 2026 — The personal data of about 110,000 members of Alliance Medinet, a Singapore company that administers corporate health benefits for employers and insurers, has been compromised by a third party, its listed parent said on Saturday 24 October. In a filing to the Singapore Exchange, Alliance Healthcare Group said someone had gained unauthorised access to the Medinet system holding its membership database, and that it notified Singapore's Personal Data Protection Commission (PDPC) on 21 October.
Two insurers that use Medinet to serve their health customers, Income Insurance and HSBC Life Singapore, have since published their own notices confirming that some of their policyholders are among those affected.
What the parent company disclosed
The one-page announcement, signed by executive chairman and chief executive Dr Barry Thng Lip Mong, says investigations are ongoing. "Based on investigations conducted to date, the personal data of approximately 110,000 members in that membership database have been compromised by a third-party," it reads.
Names, personal identification numbers and contact details are the categories it lists as potentially affected. The group's initial assessment adds two smaller and more sensitive groups. Seven members "might have their bank account information compromised", and one member's medical diagnosis "might have been breached".
The company says it moved to contain the incident as soon as it was discovered and brought in independent cybersecurity and forensic specialists. It also added round-the-clock network monitoring and dark web monitoring. Affected members are being told by Medinet, its partners or the relevant clients, and the filing says the rest of the group "are not affected by the Incident".
Two insurers confirm customer exposure
Medinet describes itself on its website as the managed-care arm of the group, offering third-party administration, a panel clinic network and digital claims handling to employers. That position puts it between insurers and the people they cover.
Income Insurance said in a press release dated 24 October that Medinet informed it of the incident on 22 October. One of its corporate accounts was affected, covering about 70 people. The data potentially involved includes names, identification numbers, mobile numbers, policy numbers and the start and end dates of cover. "There is currently no evidence that bank account information or medical information has been compromised," the insurer said, and it reported that its own systems showed no sign of compromise.
HSBC Life Singapore posted a notice on the same date. It calls Medinet one of its third-party administrators for health customers and says the incident happened outside its own systems, which were not compromised. Medinet has told the insurer that its customers' details may include names, identification numbers and contact information. HSBC Life says it currently understands that no medical records are at risk, and that Medinet has advised that policyholders' "login credentials and passwords were not affected". It does not give a number of affected customers. Both insurers say they have informed the authorities and the people involved.
A trading halt came first
The disclosure followed a quieter step on the exchange. At 07:35 on 23 October, Alliance Healthcare Group asked for a trading halt with immediate effect, giving as its reason the pending release of an announcement. The next filing listed after it on the group's investor-relations page is the cyber incident announcement. It advises shareholders to be careful when dealing in the shares and to take professional advice. The group's annual general meeting is scheduled for Tuesday 27 October.
How the notification rules work
Singapore's data protection law sets a scale threshold for telling the regulator. Under the PDPC's guide on managing and notifying data breaches, a breach involving 500 or more individuals must be notified to the Commission even if no especially sensitive category of data is involved. Once an organisation determines that a breach is notifiable, it has no more than three calendar days to tell the PDPC. Individuals, where they must be told, are notified at the same time as the Commission or afterwards.
The filing does not say when the unauthorised access began or when Medinet found it. That gap means the public record cannot show how much time passed before the 21 October report. As of 25 October the PDPC had published no statement on the incident, and no regulator has made any finding against Medinet or its parent.
What is still unknown
The company has not said how the intruder got in, how long the access lasted, or whether the data has appeared for sale or been used. It has not named the insurers or employers whose members are in the database, beyond what Income and HSBC Life have said themselves. It does not attribute the incident to any group. Alliance Healthcare Group says it will provide "a fuller update in due course".
What affected members can do
Both insurers frame their advice around scams, since a name, identification number and phone number together are enough to make a fraudulent call sound convincing. Income tells customers not to open links or attachments in unexpected messages that claim to come from it, not to share passwords or one-time passwords, and to keep an eye on their bank accounts. HSBC Life asks policyholders to check with Medinet before acting on any message about their policy. It also recommends changing app passwords regularly instead of reusing them elsewhere. A password generator can produce a fresh one that is not shared with any other account.
