1doc.sg Listed by ransomhub Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target healthcare and digital-health providers, drawn by the sensitivity of medical information and the operational pressure such organisations face to restore services quickly. In this environment, listings on criminal leak sites have become a common way for attackers to assert leverage, even when independent confirmation of the full scope remains limited.

On 22 October 2024, the Singapore-based telehealth platform 1doc.sg appeared on a listing attributed to the RansomHub ransomware group. Public detail indicates that internal files were claimed to have been exfiltrated during a ransomware attack. The number of people affected has not been disclosed, and the precise contents of the material remain unconfirmed beyond that description. For patients and clinicians who rely on digital consultation services, any such incident raises immediate questions about the confidentiality of health-related information.

Breaking down the breach

According to the available record, 1doc.sg was listed by the RansomHub group on 22 October 2024. The listing characterises the incident as a ransomware attack in which internal files were allegedly exfiltrated. No further technical details—such as the initial access vector, the duration of unauthorised presence, or the volume of data taken—have been made public. The number of individuals potentially affected is recorded as unknown. Because the information originates from a threat-actor listing rather than a confirmed disclosure by the organisation itself, the claims should be treated as assertions pending independent verification. Timing beyond the reporting date, the exact scale of any compromise, and the methods used remain undisclosed in the public facts.

The group behind it: ransomhub

RansomHub is a ransomware-as-a-service operation that emerged into wider public view in 2024. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it on a dedicated leak site if a ransom is not paid. Affiliates of the group are known to target a range of sectors, including healthcare and professional services, and to publicise victim names to increase pressure. The group’s leak-site listings function as claims of successful intrusion and data theft; they do not, by themselves, constitute verified proof of every asserted detail. In the case of 1doc.sg, the public record states only that the organisation was listed and that internal files were claimed to have been exfiltrated. No additional statements attributed specifically to RansomHub about this victim appear in the available facts.

About 1doc.sg

1doc.sg is a company focused on telehealth services, primarily based in Singapore. It operates a digital platform that connects patients with healthcare professionals, enabling online medical consultations. The service is designed to improve access to care, streamline interactions between patients and doctors, and deliver efficient healthcare solutions while emphasising privacy and data security. Organisations of this type sit at the intersection of healthcare delivery and information technology; they routinely handle personal identifiers, appointment details, clinical notes, and sometimes payment or insurance information. A breach affecting such a platform is consequential because the data involved is both sensitive and regulated, and because disruption can affect timely access to medical advice.

What data was at risk

The facts name the exposed material only as “internal files exfiltrated in ransomware attack.” No inventory of specific data categories—such as patient records, credentials, financial details, or employee information—has been publicly confirmed. Telehealth platforms of this kind typically store or process personal contact data, medical histories or consultation notes, appointment schedules, and authentication credentials. Whether any of those categories were among the internal files claimed by the group remains unconfirmed. Readers should therefore treat the precise contents as undisclosed rather than assume particular types of information were taken.

What's at stake

For individuals whose information may have been involved, the primary risks are privacy intrusion and the potential for secondary misuse of personal or health-related details. Even limited internal files can contain enough context to enable targeted phishing, social-engineering attempts, or identity-related fraud. For the organisation, the stakes include operational disruption, regulatory scrutiny under Singapore’s data-protection framework, reputational damage, and the cost of investigation and remediation. Because the number of people affected is unknown and the exact data set is unconfirmed, the full extent of real-world impact cannot yet be quantified. The incident nonetheless illustrates the broader pressure ransomware places on digital-health services that must balance accessibility with the protection of sensitive information.

What to do if you're exposed

If you have used 1doc.sg or believe your details may have been involved, begin by monitoring accounts and communications for unusual activity. Change passwords associated with the service and any reused credentials elsewhere, and enable multi-factor authentication where available. Be alert to unsolicited messages that reference medical appointments or personal details, as these can be precursors to phishing. Consider placing fraud alerts with relevant credit or identity-monitoring services if financial identifiers could be at risk. Finally, you can run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets; doing so provides an additional, practical way to assess personal exposure without relying solely on incomplete public reports.

AICompiled with AI assistance from public sources and published under our editorial standards.