Unauthorized access and information leakage at a subsidiary
Entatch Co., Ltd. (the Company's unconsolidated subsidiary)
A database managed by Entatch and its remote detailing business. Information that may have been leaked includes healthcare professionals' names, affiliated medical institutions and prefectures; users' names and email addresses; telephone numbers and email addresses provided when making reservations; names of the products and pharmaceutical companies covered by reservations; and reservation creation dates and times, meeting dates and times, and meeting status.
Unauthorized access by a third party carrying out a ransomware attack
Related procedures
Consultation with the Tokyo Metropolitan Police Department's Cybercrime Control Division and a report to the Personal Information Protection Commission
Tokyo Metropolitan Police Department Cybercrime Control Division; Personal Information Protection Commission
Company response
The Company has commissioned an external specialist organization, a forensic investigation firm, to conduct an investigation and is working with experts to identify the cause and scope of the impact and consider countermeasures. Establishment of a third-party committee or special investigation committee: Not disclosed
Applying security patches to software that accesses the database; preserving access logs and forcing a change of all passwords; working with experts to identify the cause and scope of the impact and consider countermeasures
The Company will continue its investigation through an external specialist organization to identify the cause and scope of the impact and consider countermeasures. It is warning people to be cautious of suspicious emails and other threats.
If the investigation reveals any new facts that should be disclosed, the Company will announce them promptly.
| Item | Details |
|---|---|
| Event name | Unauthorized access and information leakage at a subsidiary |
| Date of occurrence | Around 16:00 on 13 October 2026 (when the leakage was discovered) |
| Date recognized / date notice received | Around 16:00 on 13 October 2026, it was discovered that data had leaked externally from a database managed by Entatch. |
| Subject Entity | Entatch Co., Ltd. (the Company's unconsolidated subsidiary) |
| Target Locations / Products | A database managed by Entatch and its remote detailing business. Information that may have been leaked includes healthcare professionals' names, affiliated medical institutions and prefectures; users' names and email addresses; telephone numbers and email addresses provided when making reservations; names of the products and pharmaceutical companies covered by reservations; and reservation creation dates and times, meeting dates and times, and meeting status. |
| Cause | Unauthorized access by a third party carrying out a ransomware attack |
| Type of litigation or proceeding | Consultation with the Tokyo Metropolitan Police Department's Cybercrime Control Division and a report to the Personal Information Protection Commission |
| Court or authority | Tokyo Metropolitan Police Department Cybercrime Control Division; Personal Information Protection Commission |
| Investigation structure | The Company has commissioned an external specialist organization, a forensic investigation firm, to conduct an investigation and is working with experts to identify the cause and scope of the impact and consider countermeasures. Establishment of a third-party committee or special investigation committee: Not disclosed |
| Measures to prevent recurrence | Applying security patches to software that accesses the database; preserving access logs and forcing a change of all passwords; working with experts to identify the cause and scope of the impact and consider countermeasures |
| Outlook | The Company will continue its investigation through an external specialist organization to identify the cause and scope of the impact and consider countermeasures. It is warning people to be cautious of suspicious emails and other threats. |
| Planned follow-up disclosure | If the investigation reveals any new facts that should be disclosed, the Company will announce them promptly. |
Items this document does not state (13)
These are items the company does not state in this document. We do not leave them blank, nor fill them in from other sources or by inference.
The reasons the company gives
The company's own explanation, not something inferred from the numbers.Unauthorized access by a third party carrying out a ransomware attack.