Skip to content

Weekday Japan business intelligence for finance professionals.

Join the list
Tokyo Brief東 京 ブ リ ー フJapan's day, wrapped and delivered by morning.

Article

Medley suspends @link healthcare platform after confirmed intrusion

Medley suspended its @link medical-institution system and patient app on October 14 after confirming unauthorized access; patient data may have leaked from as many as 787 institutions, and no restart date has been given.

By Tokyo Brief DeskOct 15, 20262 min readMEDLEY,INC.4480
Editorial illustration of a clinic counter with a dark tablet and phone, and a disconnected cable on a server rack behind them.

Medley, the Tokyo Prime-listed healthcare software company (code 4480), has confirmed that a third party gained unauthorized access to the systems behind its @link medical-institution support platform, its patient-facing @link app and related services. The company switched the services off on the night of October 14, according to a notice dated October 15.

What happened

Medley said an external specialist body tipped it off on October 11 that unauthorized access might have occurred. An investigation followed and confirmed the intrusion.

Between the tip-off and the suspension, the company said it ran the investigation and put interim support measures in place to limit the effect on medical institutions' operations and on patients. It then suspended the services to stop damage spreading and allow further investigation.

Medley gave no restart date. It said it will announce an outlook for resuming service once the investigation results are in.

What is known about exposure

Medley said personal information of patients and others registered on the services may have been leaked. Whether any leak occurred, and how far it reached, including which data items and which institutions, is still under investigation with outside specialists.

The company said the medical institutions that could be affected number at most all of those using the services, which it put at 787. That figure is a ceiling on institutions, not a count of patients or of institutions confirmed as affected.

Response and financial impact

Medley said it has reported the incident to the Personal Information Protection Commission, Japan's data-protection regulator, and has consulted the police. It plans additional countermeasures and steps to prevent recurrence based on the investigation, and will publish results when they are established.

On earnings, Medley said it expects the effect on its consolidated results for the year ending December 2026 to be minor, and that it will disclose promptly anything further that needs reporting. That is the company's own expectation.