Japanese pharma wholesaler Toho Holdings (TSE Prime 8129) disclosed on Oct 19 that a database run by its non-consolidated subsidiary enTouch was accessed by "a third party claiming to be a ransomware group" and that data was exfiltrated. enTouch runs remote detailing, meaning online information sessions between drug companies and medical institutions, partly under contract from Toho Pharmaceutical. The leak was discovered around 16:00 (Japan time) on Oct 13. Confirmed leaked so far: names, affiliated institutions and prefectures of healthcare professionals who used the service; names and emails of platform users such as administrators and eMRs; phone numbers and emails entered when booking; product and pharmaceutical company names; and booking and meeting dates and statuses. The number affected is still under investigation. Content files and recorded video/audio weren't in the database. Toho says enTouch is isolated from other group systems, and no alteration or deletion of data has been found.

enTouch has patched the software that accesses the database, preserved logs, forced resets of all passwords, consulted the Tokyo Metropolitan Police cybercrime division, reported to Japan's Personal Information Protection Commission, and hired a forensics firm. Comparitech reports that the Black X group has claimed the attack. The company hasn't named a group. If you were an enTouch user (pharma companies, MRs, clinicians), expect targeted phishing that uses real meeting and product details.