SHINDO6

Reprowork

Personal data~170,000people

LEAK CONFIRMEDHealth / medical / treatment / Date of birthImproper disposal · Investigating

Open in the live monitor ▶
Disclosed
Jun 8, 2026
Detected
Jun 2025
Detection to disclosure
372 days
Leak
Leak confirmed
Type
Improper disposal
Status
Investigating
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityFull name, Date of birth
Account dataPatient number
ContactAddress, Phone number
Transactions & activityVisit dates, departments, admission information
Special-care dataDiagnoses, test results, allergy information, parts of nursing records

Not leaked

  • No My Number, bank account or credit card numbers

How many

  • Hokkaido Medical Center (approx. 1.76 million records in total) ~170,000 people
  • Maximum possible scope up to 510,000 people
  • Hokkaido Cancer Center (approx. 25,000 records in total) ~8,800 people
  • Hokkaido Government 697 people
  • Shin-Sapporo Houwakai Hospital (separate record in the July 2026 slice) 4,721 people

Who is affected

  • Patients
  • People in Hokkaido Government records

Cause

The disposal contractor failed to destroy some HDDs that should have been destroyed, and they were sold in online auctions

Timeline

  1. Hokkaido Medical Center outsourced the disposal of about 750 HDDs
  2. A buyer from an online auction reported the leak
  3. First disclosure
  4. Criminal complaint filed
  5. Individuals notified
  6. Shin-Sapporo Houwakai Hospital made its own announcement

Response

  • Notified individuals
  • Vendor review
  • Change process

Individual letters to affected people; multi-person checks required in the disposal process; physical destruction on site as a rule; stricter selection and management of contractors. The MHLW warned all medical institutions

What you should do

  1. Health data can't be taken back. Don't answer blackmail; call the police (#9110) or the consumer hotline (188)
  2. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  3. Watch for unexpected mail or invoices; your address is hard to change
  4. Check the company's notice to see if you're affected

Lessons for companies

  1. Put security requirements, audit rights and reporting deadlines in vendor contracts
  2. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  3. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources