SHINDO3

Tokyo Women's Medical University Hospital

Tokyo Women's Medical University

Personal data~100people

POSSIBLE LEAKHealth / medical / treatment / Member / user IDTheft · Investigating

Open in the live monitor ▶
Disclosed
Feb 25, 2025
Leak
Leak possible
Type
Theft
Status
Investigating
Security spend
Not checked yet
Compensation
Not announced

What leaked

Account dataPatient ID
Special-care dataUnderlying conditions, medications, blood test data, presence of side effects
IdentityGender, Age

How many

  • Patients whose data was collected for research over the last five years ~100 people

Who is affected

  • Patients

Cause

A PC holding patient data was stolen in the hospital. The data may also have been used for research without going through ethics review

Timeline

  1. Early February
  2. Date of the Security NEXT report

Response

  • Notified individuals

Reported to the relevant ministries and filed a theft report with the police. Apologized and will notify affected people in writing

What you should do

  1. Health data can't be taken back. Don't answer blackmail; call the police (#9110) or the consumer hotline (188)
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources