SHINDO4

Smith & Nephew KK

Personal data16people

LEAK CONFIRMEDHealth / medical / treatment images / Date of birth imagesInsider misuse · Investigating

Open in the live monitor ▶
Disclosed
Aug 12, 2026
Detected
Jun 2026
Detection to disclosure
72 days
Leak
Leak confirmed
Type
Insider misuse
Status
Investigating
Security spend
Not checked yet
Compensation
Not announced

What leaked

Special-care dataX-ray images (image)
IdentityName (1 case) (image), Date of birth (image), Age (image), Gender (image)
Account dataPatient ID (image)

How many

  • Patients at 9 hospitals (images posted to the internal chat) 16 people
  • Hospitals that published notices at least 7 organizations

Who is affected

  • Patients

Cause

Employees of a medical device company photographed patients' X-ray images in operating rooms and posted them to an internal group chat that dozens of employees could see. The company says it had verbal permission; the hospitals say they could not confirm this

Timeline

  1. Images posted to the company group chat in September-October 2025
  2. Came to light through a newspaper inquiry
  3. Osaka Metropolitan University Hospital announced
  4. Nippon Kokan Fukuyama Hospital, Kobe University Hospital and Saitama Kyodo Hospital announced
  5. Takarazuka City Hospital announced
  6. Kanazawa University Hospital and St. Marianna University Hospital announced

What you should do

  1. Health data can't be taken back. Don't answer blackmail; call the police (#9110) or the consumer hotline (188)
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources