Incident
Published 2026-10-24 New
Verified 2026-10-25

Alliance Healthcare Group says personal data of about 110,000 members in subsidiary Alliance Medinet's membership database was compromised by a third party; bank account details of 7 members and 1 member's medical diagnosis may also be affected

Singapore-listed Alliance Healthcare Group said in an SGX filing on 24 October 2026 that its subsidiary Alliance Medinet Pte. Ltd. recently experienced a cyber incident involving unauthorised access to its system containing its membership database, and that, based on investigations to date, the personal data of approximately 110,000 members in that database had been compromised by a third party.

The company said the types of personal data potentially affected include names, personal identification numbers and contact information, and that, based on its initial assessment, 7 members might have had bank account information compromised and 1 member's medical diagnosis might have been breached.

It said affected members are being notified by Medinet and/or its partners and relevant clients, that it engaged independent cybersecurity and forensic specialists, put in place 24-hour network monitoring and dark web monitoring, and reported the incident to Singapore's Personal Data Protection Commission on 21 October 2026; investigations are ongoing and the rest of the group is not affected.

Insurers Income Insurance and Singlife said some of their customers were affected through Alliance Medinet and that there is currently no evidence their own systems were compromised, according to The Straits Times. Primary: Alliance Healthcare Group SGX announcement (24 Oct 2026); wires: The Straits Times, CNA.

Product
Alliance Medinet (Singapore managed healthcare / third-party administrator) — membership database
Versions
n/a — unauthorised access to membership database; access method not disclosed
Exploited in Australia?
unknown
Patch to
Members notified by Alliance Medinet, their insurer or employer: watch for phishing and scam calls that use your name, ID number and contact details, and never give out passwords or one-time codes. The 7 members told their bank details may be affected should alert their bank. Third-party administrators: restrict and monitor bulk reads of membership databases.

breaches