SHINDO3

St. Joseph Hospital

Insider misuseSize not disclosed

LEAK CONFIRMEDDate of birth / Postal addressClosed (final report)

Open in the live monitor ▶
Disclosed
Mar 12, 2026
Detected
Mar 2026
Detection to disclosure
11 days
Leak
Leak confirmed
Type
Insider misuse
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

IdentityName, Date of birth
ContactAddress, Phone number, Email address

Who is affected

  • Hospital volunteers

Cause

While employed, the former employee copied the roster to external media and later used it to recruit for a private circle

Timeline

  1. A volunteer's relative reported inappropriate solicitation
  2. First disclosure

Response

  • Data deleted
  • Change process
  • Staff training

Confirmed deletion with the former employee present; tightening exit procedures, training on confidentiality and data protection, and stronger physical and technical controls

What you should do

  1. Don't open links in emails from this company. The apology email itself may be fake
  2. Treat refund or apology calls and texts as scams. Call back only on the number from the official site
  3. Watch for unexpected mail or invoices; your address is hard to change
  4. You can be affected without ever using this service (parcel recipients etc.). Check any notice you receive
  5. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources