1doc.sg listed on RansomHub leak site

• Ransomware group: RansomHub
• Country: Singapore
• Sector: Healthcare
• Announcement date: October 22, 2024

RansomHub claims data breach at 1doc.sg

The Singapore-based digital healthcare provider 1doc.sg has been listed on the leak site associated with the RansomHub ransomware group. On October 22, 2024, the group announced that they had successfully compromised the institution's data. This announcement marks a significant incident for the telehealth sector, as the group claims to have gained access to sensitive information belonging to the organization.

Ransomware groups often utilize a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. The threat of releasing this stolen information on a public leak site serves as a secondary layer of pressure, intended to coerce the victim into paying a ransom to prevent the public disclosure of their private records.

In this specific instance, the RansomHub group asserts that they have obtained access to the institution's internal data. The group has threatened to release the information publicly if their demands are not met. While the specific ransom amount has not been disclosed, the threat of a public leak remains a central component of the group's extortion strategy.

Data types identified in the leak

The information released by the attackers includes screenshots that purportedly show various sensitive documents. These files suggest a wide range of medical and personal information has been targeted. According to the claims made by the group, the stolen data includes several categories of highly sensitive information:

• Patient medical records
• Laboratory results
• Prescriptions
• Invoices
• Referral forms
• Personal identification information

The presence of such diverse data types—ranging from clinical medical reports to financial invoices and personal identification—indicates a deep level of access into the organization's data repositories. The exposure of such information carries significant implications for the privacy of the individuals involved.

About 1doc.sg

1doc.sg is a digital healthcare platform operating out of Singapore. The organization's primary mission is to improve access to healthcare services by utilizing digital tools to connect patients with medical professionals. This connection is facilitated through online medical consultations, making the platform a key player in the regional telehealth landscape.

Implications and security considerations

The claims made by RansomHub pose a severe risk regarding the exposure of patients' sensitive medical histories and personal data. For a healthcare provider, the integrity and confidentiality of patient information are paramount. A breach of this nature can lead to significant secondary risks for the affected individuals, such as the potential for identity theft or the targeting of patients through sophisticated phishing attacks. When medical histories are exposed, attackers can use that specific knowledge to craft highly convincing social engineering campaigns.

Beyond the direct impact on patients, the organization faces substantial institutional risks. Such a breach may lead to legal sanctions under Singapore's Personal Data Protection Act (PDPA), which governs how organizations must handle and protect personal data. Furthermore, the organization may suffer significant reputational damage, which can be difficult to recover from in the highly sensitive healthcare sector.

RansomHub is identified as a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. Reports indicate that the group reportedly ceased operations in early 2025 and is known to have absorbed affiliates from the ALPHV group. For organizations operating in the telehealth and healthcare sectors, this incident highlights the necessity of robust data security processes. To mitigate such risks, organizations typically must review their security frameworks, ensure rigorous encryption of data at rest and in transit, and implement comprehensive notification protocols to inform affected individuals when a breach is suspected or confirmed.