SHINDO4

Nippon Medical School Musashi Kosugi Hospital

Nippon Medical School Foundation

Patients~130,000people

LEAK CONFIRMEDDate of birth / Postal addressRansomware · Recovering

Open in the live monitor ▶
Disclosed
Feb 13, 2026
Detected
Feb 9, 2026 01:50 JST
Detection to disclosure
4 days
Leak
Leak confirmed
Type
Ransomware
Status
Recovering
Security spend
Not checked yet
Compensation
Not announced

What leaked

Account dataPatient ID
Employment & HRStaff ID
IdentityFull name, Gender, Date of birth
ContactAddress, Phone number

Not leaked

  • Patient medical records
  • Credit card information
  • My Number card information

How many

  • Patients ~130,000 people
  • Staff and trainees ~1,700 people

Who is affected

  • Patients
  • Staff
  • Trainees

Cause

Unauthorized access exploiting a vulnerability in a VPN device used to maintain medical equipment (patient vital-sign monitoring). Three nurse-call servers and one ward terminal were hit

Timeline

  1. Intrusion through the maintenance VPN device
  2. Database on the nurse-call server stolen
  3. A nurse-call terminal fault revealed the attack; systems were cut off
  4. First announcement
  5. Security hardening work completed
  6. Stolen data confirmed published on a leak site
  7. Fifth report

Response

  • Blocked the entry point
  • Patched

Cut off systems and carried out security hardening

What you should do

  1. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  2. Watch for unexpected mail or invoices; your address is hard to change
  3. Expect targeted phishing posing as HR or interview contacts
  4. Check the company's notice to see if you're affected

Lessons for companies

  1. Patch internet-facing servers, VPNs and admin panels first. Exploits follow disclosure within days
  2. Put security requirements, audit rights and reporting deadlines in vendor contracts
  3. Offline backups with restore drills; segment the network
  4. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  5. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources