SHINDO4

Toranomon Hospital

Federation of National Public Service Personnel Mutual Aid Associations

Patients170people

LEAK UNCLEARHealth / medical / treatment / Name reading (kana)Loss · Closed (final report)

Open in the live monitor ▶
Disclosed
Sep 26, 2025
Detected
Aug 1, 2025
Detection to disclosure
56 days
Leak
Unknown
Type
Loss
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityName in katakana
Special-care dataTest items and test results

How many

  • Patients 170 people

Who is affected

  • Patients

Cause

A work USB memory stick used by a Mediscket employee on laboratory work subcontracted through SRL went missing

Timeline

  1. Detected
  2. Reported to authority
  3. First disclosure

Response

  • Notified individuals
  • Vendor review
  • Staff training

What you should do

  1. Health data can't be taken back. Don't answer blackmail; call the police (#9110) or the consumer hotline (188)
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Put security requirements, audit rights and reporting deadlines in vendor contracts
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources