--- title: "Alliance Medinet membership database compromise" description: "Alliance Medinet disclosed a membership database compromise involving approximately 110,000 members, with insurer-specific impacts still under investigation." incident_type: "Data incident" status: "active" last_modified: "2026-10-26" canonical_url: "https://www.ally.security/incidents/alliance-medinet-membership-database-compromise-2026" markdown_url: "https://www.ally.security/incidents/alliance-medinet-membership-database-compromise-2026.md" stix_url: "https://www.ally.security/incidents/alliance-medinet-membership-database-compromise-2026/stix.json" --- # Alliance Medinet membership database compromise Unauthorized access at a healthcare administrator exposed member data and prompted notifications by downstream insurers. Last modified Oct 26, 2026 · 3 sources ## Summary - **Environment:** Alliance Medinet membership database and downstream insurer records - **Operational impact:** Containment measures reported; no service outage established in the reviewed notices - **Financial impact:** No verified financial loss in the reviewed evidence ## What happened [Alliance Healthcare Group](https://alliancehealthcare.com.sg/) disclosed unauthorized access to the membership database of its subsidiary Alliance Medinet on October 24, 2026. Its [SGX announcement](https://links.sgx.com/FileOpen/AHG_Ann_Cyber%20Incident_2026.10.24_Final%20SGX.ashx?App=Announcement\&FileID=909072) said approximately 110,000 members’ personal data had been compromised, with the investigation continuing. The filing does not establish when the intrusion began or was discovered. [1](#source-1) ## Impact Potentially affected information included names, identification numbers and contact details. The initial assessment also identified possible bank-account information exposure for seven members and a possible medical-diagnosis exposure for one member. These narrower categories were still being investigated. [1](#source-1) [Income Insurance](https://www.income.com.sg/) reported about 70 affected individuals in one corporate account. Its notice included possible exposure of policy numbers and coverage dates alongside identifiers and contact details. It found no current evidence of bank or medical information compromise and no indication that its own systems were compromised. [2](#source-2) [Singlife](https://singlife.com/) said 323 Employee Benefits customers might be affected. Potential fields included names, NRIC numbers, birth dates, contact details, corporate email addresses, company names, and policy or membership details. It reported no evidence of compromise to its own systems or network, and no indication that health or medical information was affected. [3](#source-3) The insurer figures describe downstream subsets and should not be added to Medinet’s approximate total. Their limited no-evidence statements do not negate the vendor’s findings about other members. Alliance Healthcare said its other subsidiaries were unaffected. [1](#source-1) [2](#source-2) [3](#source-3) ## Timeline ### October 21, 2026 — Incident reported to privacy regulator The group reported the incident to Singapore’s Personal Data Protection Commission. [1](#source-1) ### October 22, 2026 — Insurers informed Income and Singlife said Medinet informed them of the incident. [2](#source-2) [3](#source-3) ### October 24, 2026 — Membership database compromise disclosed The issuer and downstream insurers published notices describing the compromise and their respective affected populations. [1](#source-1) [2](#source-2) [3](#source-3) ### October 26, 2026 — Briefing updated This briefing was last reviewed and updated on October 26, 2026. ## Threat Group & Attack Vector The issuer confirmed unauthorized database access but did not identify the entry route or an exploited vulnerability. [1](#source-1) ### Actors - No threat actor is identified in the reviewed original notices. ### TTPs - The available evidence does not support a specific MITRE ATT\&CK technique mapping. ## Response Alliance Healthcare said it acted immediately to contain the incident. It engaged independent cybersecurity and forensic specialists, strengthened controls, and introduced continuous network and dark-web monitoring. Notifications were underway through Medinet, its partners and clients. [1](#source-1) [Income’s notice](https://www.income.com.sg/about-us/corporate-information/press-releases/alliance-medinet-pte-ltd-cyber-incident) and [Singlife’s notice](https://singlife.com/en/about-us/newsroom/2026/alliance-medinet-cyber-incident) describe notifying authorities and contacting affected parties. The investigation had not established a final, deduplicated population or a complete per-person data inventory. [1](#source-1) [2](#source-2) [3](#source-3) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Cyber Incident — Alliance Medinet official · Alliance Healthcare Group Limited · Oct 24, 2026 ### Alliance Medinet Pte Ltd Cyber Incident official · Income Insurance Limited · Oct 24, 2026 ### Cyber incident involving Third Party Service Provider Alliance Medinet official · Singlife · Oct 24, 2026
Evidence ledger Review the supporting structured claims. 1. **Vendor Of · 100% confidence · current** Alliance Medinet Pte. Ltd.: Income Insurance Limited 2. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: Potentially affected fields include names, identification numbers and contact details; the initial assessment also identified possible bank-account exposure for seven members and a possible medical-diagnosis exposure for one member. 3. **Affected Individual Count · 100% confidence · current** Alliance Medinet membership database compromise: 110,000 4. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: The vendor acted immediately to contain the incident, engaged independent forensic specialists and strengthened controls with continuous network and dark-web monitoring. Member notifications were underway. 5. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: Singlife said 323 Employee Benefits customers might be affected, with potential exposure of names, NRIC numbers, birth dates, contacts, corporate email, company names and policy or membership details. 6. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: Alliance Healthcare reported unauthorized access to Medinet’s membership database. Its ongoing investigation identified approximately 110,000 members whose personal data had been compromised. 7. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: Group discloses membership database compromise 8. **Occurred At · 100% confidence · current** Downstream insurers informed: 2026-10-22 9. **Disclosed At · 100% confidence · current** Alliance Medinet membership database compromise: 2026-10-24 10. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: Income was informed on October 22 and reported about 70 individuals in one corporate account affected. Potential fields included identifiers, contacts, policy number and coverage dates. 11. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: The group said its other subsidiaries were not affected; the public filing does not give the intrusion or discovery date. 12. **Subsidiary Of · 100% confidence · current** Alliance Medinet Pte. Ltd.: Alliance Healthcare Group Limited 13. **Occurred At · 100% confidence · current** Incident reported to PDPC: 2026-10-21 14. **Occurred At · 100% confidence · current** Group discloses membership database compromise: 2026-10-24 15. **Affected Organization · 100% confidence · current** Alliance Medinet membership database compromise: Income Insurance Limited 16. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: The incident was reported to Singapore’s Personal Data Protection Commission on October 21. 17. **Affected Organization · 100% confidence · current** Alliance Medinet membership database compromise: Alliance Medinet Pte. Ltd. 18. **Affected Organization · 100% confidence · current** Alliance Medinet membership database compromise: Singlife 19. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: Singlife was informed on October 22, notified authorities and contacted affected customers. It reported no evidence of compromise to its own systems or network and no indication of affected health or medical information. 20. **Vendor Of · 100% confidence · current** Alliance Medinet Pte. Ltd.: Singlife 21. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: Downstream insurers informed 22. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: Income said there was no current evidence of bank or medical information compromise and no indication its systems were compromised. It activated response processes and informed authorities and affected parties. 23. **Resulted In · 100% confidence · current** Alliance Medinet membership database compromise: Incident reported to PDPC