Toho Holdings said a ransomware attack on a non-consolidated subsidiary leaked part of the data held in a database used for remote detailing, the business of giving medical institutions product information remotely. The company disclosed the incident on 19 October 2026, and said it was discovered at about 4pm on 13 October.
What may have leaked
The company lists five categories: names, medical institutions and prefectures of healthcare workers who used the service; names and email addresses of platform users, including administrators; phone numbers and email addresses entered as booking contacts; product and drugmaker names tied to bookings; and booking creation times, meeting times and meeting status.
The number of people and records affected, and the detailed scope, are still being investigated. Content files used to deliver information and recordings or audio data were not on the database, so they fall outside the leak, the company said.
Containment and exposure
Toho Holdings said the subsidiary's system is fully isolated from other group systems, so no other group systems were affected. It also said no data tampering or deletion has been confirmed and the subsidiary's business continues. The remote detailing work is done partly under commission from Toho's drug-wholesale subsidiary and partly directly for drugmakers.
The subsidiary has patched the software that accesses the database, preserved access logs, forced a password change for all accounts, consulted the Tokyo Metropolitan Police cybercrime unit and reported to the Personal Information Protection Commission. For work done under the wholesale subsidiary's commission, that subsidiary made the report. A forensic investigator has been engaged to establish the cause and the extent of the impact. The company asked people to watch for suspicious emails and said it would announce new findings promptly.