Pharma DIGITAL: a vendor-run portal for healthcare professionals may have exposed data on more than 500,000 of them.

No medical records were involved, and that is not the reassurance it sounds like. What leaked, or may have leaked, is the contact layer between a drug company and the doctors it informs: who they are, where they work, what they specialise in and which company staff they deal with. That is exactly what a convincing phishing campaign against healthcare needs.

What has been disclosed

On 6 October 2026, Asahi Kasei Therapeutics (named Asahi Kasei Pharma until April 2026) announced that Pharma DIGITAL, its information website for healthcare professionals (HCPs) in Japan, had been attacked. The member database linked to the site may have been viewed or taken. Asahi Kasei Therapeutics notice (Japanese)

The site is run by a contractor, 医薬情報ネット (Pharmaceutical Information Net, PIN), which operates it and manages its data. PIN published its own notice the same day. PIN notice (Japanese); PIN notice, PDF

Timeline. PIN says it confirmed the unauthorized access on 2 October and reported it to Asahi Kasei Therapeutics the same day. The site was taken offline at once. On 9 October only a limited temporary page, with no login, was online (see the 9 October update).
Containment. Both companies say the access route has been fixed and no further unauthorized access has been seen.
Status. No misuse has been confirmed. The authorities have been notified, external specialists are investigating, and affected HCPs will be contacted individually, by email among other means.
Not stored on the site: credit card data and special-care-required personal information, the Japanese legal category that covers medical history.

Group	Data that may have been viewed or taken	People (maximum)
Healthcare professionals	Name, facility name, facility address, profession, department, etc.	about 514,000
Healthcare professionals	The above plus email address, etc.	about 44,000
Asahi Kasei Therapeutics employees	Name, email address, photo	about 700

The two HCP rows are listed separately, and Japanese media have added the groups to a maximum of about 560,000 people, or 558,700 including employees. Nikkei report (Japanese) Neither notice says whether the 44,000 overlap with the 514,000. The word "etc." in both rows means the field list is not complete.

When we checked early on 7 October (JST), the Pharma DIGITAL address returned a generic maintenance page that lists upcoming web seminars with registration links. It did not mention the incident.

Update, 9 October: a limited temporary site, and still no cause

As of about 10:00 JST on 9 October, neither company has published a follow-up. Asahi Kasei Therapeutics' news list still ends with its notice of 6 October and PIN's news page with its own notice of the same day. JMDC, PIN's main shareholder, has published nothing about the incident. How the attacker got in, how long access lasted and whether data was copied are still not disclosed. Asahi Kasei Therapeutics news (Japanese); PIN news (Japanese); JMDC news (Japanese)

What has changed is the site itself:

Pharma DIGITAL now serves a temporary page. On 7 October the address returned a maintenance page (HTTP 503). On 9 October it returned a page (HTTP 200) that calls itself Pharma DIGITAL's temporary site, says services have been restricted since 2 October because of the unauthorised access, and links to the 6 October notice. Pharma DIGITAL temporary site (Japanese)
Four services, no login. The page has buttons for package inserts, requests for materials and disposal bags, the Recomodulin utility tools and the list of company-hosted lectures. It offers no login or registration. Product questions go to Asahi Kasei Therapeutics' own enquiry page, and questions about maintenance and web lectures to the Pharma DIGITAL office at an asahi-kasei.co.jp address.
The address is the official one. Asahi Kasei Therapeutics' website links to it as its information for healthcare professionals, and it is the domain our hunting queries treat as legitimate.
The notice is unchanged. It still gives the inquiry form as an x.gd short link, alongside the two phone numbers.

Editorial assessment. A limited site with no login gives a clean rule for now: any email, SMS or call saying Pharma DIGITAL has reopened and asking a doctor to log in, re-register or confirm their details is suspicious until the companies announce a reopening on their own websites. Tell MRs and the medical information centre, so they can say so plainly when doctors ask. When the member area returns, expect lures that copy its wording. The reopening notice should name the address to use, say whether passwords must be reset, and contain no shortened links.

The wider wave. On 8 October JPCERT/CC warned of a run of unauthorised access to Japanese organisations' web services around September. It describes three kinds of case, scanning for known vulnerabilities, abuse of APIs and a Metabase flaw, and notes that victims include systems never meant for public use. It does not name organisations, and neither notice says how Pharma DIGITAL was entered, so we do not link the two. Its countermeasures fit a vendor-run member site well: access control on every API endpoint, per-function rate limits, expiring least-privilege tokens, no admin functions on the internet, and no data kept past its purpose. JPCERT/CC alert (Japanese). Our 60-day review of Japanese breach notices counts Pharma DIGITAL among 13 notices that trace back to a supplier or platform.

Other PIN clients. A news search on the morning of 9 October found no notice from any of the other 23 drug companies PIN lists as clients. We did not re-check each company's website; the table below shows the check of 7 October.

Update, 7 October: is any other drug company affected?

PIN does not only run Pharma DIGITAL. It also provides marketing support, conference and research-paper databases, convention support for company-hosted lectures and the Medinew marketing site. Its homepage and company profile name 24 pharmaceutical companies as its main clients, "and many others". PIN homepage, client list (Japanese); PIN company profile (Japanese)

On the morning of 7 October (JST) we checked the Japanese website of every company on that list and searched the news for notices about this incident. Only Asahi Kasei Therapeutics has published one. None of the other 23 has said its data was involved, and none has said it was not.

Being on PIN's client list does not mean a company's data was affected. So far the notices describe only the member database connected to Pharma DIGITAL. The open question is whether any other client's data, or the systems holding it, share hosting, accounts or administrators with that database.

#	Company, in the order PIN lists them	Notice about this incident (checked 7 Oct, about 11:30 JST)
1	Asahi Kasei Therapeutics	Yes. Press release of 6 October naming PIN as its contractor
2	Astellas Pharma	None found
3	AstraZeneca K.K.	None found
4	AbbVie GK	None found
5	EA Pharma	None found
6	MSD K.K.	None found
7	Ono Pharmaceutical	None found
8	Kyorin Pharmaceutical	None found
9	Gilead Sciences K.K.	None found
10	Sanofi K.K.	None found
11	Sun Pharma Japan	None found
12	Daiichi Sankyo	None found
13	Takeda Pharmaceutical	None found
14	Tanabe Pharma	None found
15	Chugai Pharmaceutical	None found
16	Toa Eiyo	None found
17	Eli Lilly Japan	None found
18	Nippon Shinyaku	None found
19	Nihon Servier	None found
20	Nippon Boehringer Ingelheim	None found
21	Bayer Yakuhin	None found
22	BioMarin Pharmaceutical Japan	None found
23	Pfizer Japan	None found
24	Janssen Pharmaceutical K.K. (Johnson & Johnson Innovative Medicine)	None found

"None found" means no notice about this incident on the company's Japanese website or in news searches when we checked. A notice could still follow, so check again before relying on this table.

Other details from the past day

PIN's owner. PIN's company profile names JMDC, a listed healthcare-data company, as its main shareholder. JMDC's website had no notice about the incident when we checked. JMDC news (Japanese)
A certificate is not evidence for one system. PIN's website displays ISO/IEC 27001 certification (registration JQA-IM1377). That shows an audited security management system exists. It does not show that a particular database was configured safely, so ask vendors for evidence about the specific system as well as the certificate.
A new inquiry number. The Asahi Kasei Therapeutics notice gives PIN's security inquiry line as 03-6381-5788 until 7 October and a free-dial number, 0120-88-2566, from 8 October. MRs and call centres should quote only the numbers in the official notice: a number that changes is an easy hook for fake "support" calls.
The site is still offline. At midday on 7 October, Pharma DIGITAL still returned a maintenance page (HTTP 503) that lists upcoming web seminars with registration links.
PIN's commitment. PIN told the trade press it is fundamentally reviewing its security management and how it handles information in contracted work. Mix Online (Japanese)

If your company is on this list, ask PIN in writing which of your data it holds and on which systems; whether those systems share hosting, accounts or administrators with the Pharma DIGITAL database; and what its logs show for the weeks before 2 October. The vendor questions in the templates section below can be sent as they are.

The second vendor-run service with a leak this year

This is not the company's first disclosure of 2026. On 24 July, Asahi Kasei Therapeutics reported a leak from RA Connect, a patient support programme for its rheumatoid arthritis drug Kevzara, run by CMIC Healthcare Institute (CHI). Asahi Kasei Therapeutics, July notice (Japanese); CHI notice (Japanese)

	RA Connect (July)	Pharma DIGITAL (October)
Operator	CMIC Healthcare Institute	医薬情報ネット (PIN)
Service	Patient support programme	Information site for HCPs
People affected	1,940 (246 patients, 1,535 HCPs, 159 employees)	up to about 558,700
Reported to Asahi Kasei Therapeutics	13 July; CHI dates the access to 15 June	2 October, the day PIN confirmed it
Stated cause	Files in a web-accessible area were accessed (CHI); the company cited operational failures in data handling and access control, and supervision that did not work	Not yet disclosed
Commitment	Strengthen supervision of contractors	Strengthen supervision of contractors further

The faster report this time is real progress. The pattern matters more: a drug company's patient and HCP data increasingly lives at agencies, CROs and marketing vendors, and "we will strengthen supervision" has now been promised twice. Supervision needs evidence, such as access reviews, test results and log retention, not just contract clauses.

Why this data is valuable without any medical records

Specialty turns a list into a target map. Department and profession let an attacker send rheumatologists a rheumatology invitation and haematologists a haematology one. The web seminars listed on the maintenance page span spine surgery, rheumatoid arthritis, sepsis, DIC, osteoporosis and blood disorders.
Two kinds of reach. About 44,000 email addresses allow direct phishing. About 514,000 facility names and addresses allow letters, phone calls and messages to hospitals and clinics that look routine.
Employee data builds personas. Names, email addresses and photos of about 700 staff are enough to impersonate a medical representative (MR) convincingly, and they reveal the company's address format for everyone else.
The traffic is expected. Doctors routinely receive seminar invitations, safety information and product updates from drug companies by email. Content alone will not separate a fake from the real thing.
The incident itself is a lure. Members have been told to expect individual emails about the incident. The helpline number changes on 8 October. The inquiry form is published as a link shortener address (x.gd), which recipients cannot check by reading it. Each is a legitimate event an attacker can imitate. Notices that ask people to distrust links work best when they contain none and use only domains the reader can verify.

The attacker's playbook: what this data enables

No misuse has been confirmed. This is the analysis a red team would run, so that defenders know what to expect. Techniques are mapped to MITRE ATT&CK.

Step	What it would look like here	ATT&CK
Way in at the vendor	Not disclosed. Common routes into an internet-facing member site: a web-application flaw, an exposed admin interface, or stolen vendor or hosting credentials	T1190 Exploit Public-Facing Application; T1078 Valid Accounts; T1199 Trusted Relationship
Collection and exfiltration	Reading or exporting the member database; the notices say "viewed or taken", so exfiltration is not confirmed	TA0009 Collection; TA0010 Exfiltration
Targeting	Split the list by profession and department; pick lures per specialty	T1589.002 Email Addresses; T1591.004 Identify Roles
Infrastructure	Register lookalike domains of the portal, the vendor or the brand; set up sending accounts	T1583.001 Domains; T1585.002 Email Accounts
Delivery	"Pharma DIGITAL has reopened, please register again", "follow-up on the incident: confirm your details", or a seminar invitation with a link or QR code	T1566.002 Spearphishing Link
Persona	A call from the "new helpline", or a message from an MR using a real name and photo	T1566.004 Spearphishing Voice; T1656 Impersonation
Objective	HCP passwords reused on other medical portals, payment details for "seminar fees", or malware on hospital PCs through attachments	T1078 Valid Accounts; T1204 User Execution

Two points shape the defence. Most of these steps happen outside your network, so email, DNS and brand monitoring matter more than endpoint alerts. And the lures will not stop at Asahi Kasei Therapeutics: a list of Japanese doctors by specialty is useful for impersonating any drug company.

The defender's playbook for pharma teams

1. This week: find out whether your vendors are involved

Check for a direct link. PIN's website lists more than 20 pharmaceutical companies as clients, including several of the largest operating in Japan. It also describes services beyond Pharma DIGITAL: a database of physicians' conference activity, KOL and physician-targeting data, and CRM and marketing-automation integration. PIN website (Japanese) Being on that list does not mean a company is affected, and neither notice says other clients were involved. If you use PIN, ask in writing (template below).
Inventory every HCP-facing service a vendor runs for you: HCP portals, seminar registration, medical-information sites, marketing automation, KOL databases, sample-request forms and patient support programmes. For each, record who runs it, what data it holds and how it connects to your systems (single sign-on, CRM sync, API keys).
For any connection into your environment, follow stages 1 and 4 of the supplier breach playbook: map the access, then restrict, rotate and monitor it.

2. Prepare for impersonation of your own company

Publish one page that lists your official domains for HCP communication: the portal, the seminar platform and the sending domains. Link it from every notice.
Send notices without links or shortened URLs. Tell HCPs to open the portal from a bookmark or from your corporate website.
Enforce DMARC (p=reject or p=quarantine) on every domain you send from, including portal and campaign domains, so exact-domain spoofing fails.
Watch for lookalike domains of your portal and brand names, and agree a takedown route in advance. In Japan, JPCERT/CC accepts requests concerning phishing sites.
Brief MRs, MSLs and the medical information centre with a short script and a way for HCPs to verify them, such as calling back through the main number on the corporate site.
Check staff accounts on vendor portals. Where employees have profiles or admin accounts on a vendor-run site, find out what is stored, and treat any portal password as exposed if it may be reused elsewhere. The account compromise playbook covers resets and sign-in review.

3. If the affected vendor is yours

Suspend data flows to and from the vendor (CRM sync, single sign-on, API keys), rotate shared secrets, and preserve your own logs.
Request the vendor's evidence: affected systems, data, time window, indicators and the logs reviewed.
Under Japan's APPI, the business that entrusts personal data must supervise its processor (Article 25), and the entrusting business is usually the one that reports. A leak caused by unauthorized access, or one affecting more than 1,000 people, is reportable to the Personal Information Protection Commission. The commission expects a prompt report within about 3–5 days of learning of the incident, and a final report within 30 days, or 60 days when the cause is a wrongful act such as an attack. PPC: leak response and reporting (Japanese)

4. Which teams should act

Team	Exposure to review	Next step	Evidence needed
Third-party Risk / Procurement	Vendors that run HCP portals, seminar sites and targeting data	Send the vendor questions below; record answers with dates	Written answers, contract clauses, sub-processor list
Email Security	Mail naming Pharma DIGITAL, the vendor or your own portal from unofficial domains	Run the hunting queries; block confirmed lookalikes with a review date	Message list, recipients, click records
Commercial and Medical (MR, MSL, medical information)	HCP questions and impersonation of staff	Brief teams with the script; log reports of fake contact	Report log with dates and channels
IT Operations (identity)	Staff accounts on vendor-run portals	Reset reused passwords; review sign-ins	Account list, reset records
Legal / Privacy	Personal data held by HCP-facing vendors	Confirm supervision evidence and reporting readiness	Data inventory, processor agreements
SIEM / SOC	Visits to lookalike domains from company devices	Add the DNS and proxy queries as scheduled searches	Query results with time range and sources

Hunting: is the lure reaching you?

No indicators have been published. The companies have not released attacker IP addresses, domains or sender addresses. The queries below search by theme instead: mail that names Pharma DIGITAL or its operator but comes from elsewhere, and devices that contact lookalike domains. Add your own portal and brand names to the patterns to watch for impersonation of your company.

All queries are illustrative and were not run against live data. Table and field names were checked against vendor documentation on 7 October 2026 (JST). Expect noise: news coverage and internal discussion will also match.

1. Inbound mail naming Pharma DIGITAL or its operator from other domains. Microsoft Defender XDR advanced hunting; needs Defender for Office 365 for EmailEvents and EmailUrlInfo.

// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Inbound mail since 2 Oct 2026 that names Pharma DIGITAL or its operator but was not sent from their domains.
// Add your own HCP portal and brand names to LurePattern to watch for impersonation of your company.
let Since = datetime(2026-10-02T00:00:00Z);
let LurePattern = @"(?i)pharma ?digital|ファーマデジタル|医薬情報ネット|REPLACE_WITH_YOUR_PORTAL_NAME";
let OfficialDomains = @"(?i)(^|\.)(asahi-kasei\.co\.jp|akp-pharma-digital\.com|pin-japan\.com|pin-japan\.co\.jp)$";
EmailEvents
| where Timestamp > Since
| where EmailDirection == "Inbound"
| where Subject matches regex LurePattern or SenderDisplayName matches regex LurePattern
| where not(SenderFromDomain matches regex OfficialDomains)
| join kind=leftouter (
    EmailUrlInfo
    | where Timestamp > Since
    | project NetworkMessageId, UrlDomain
    ) on NetworkMessageId
| summarize Recipients = dcount(RecipientEmailAddress), UrlDomains = make_set(UrlDomain, 10),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by SenderFromAddress, SenderFromDomain, Subject, DeliveryAction
| order by FirstSeen asc
| take 500

2. Company devices contacting lookalike domains. Microsoft Defender XDR advanced hunting; needs Defender for Endpoint for DeviceNetworkEvents.

// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Devices that contacted domains resembling Pharma DIGITAL, other than the official site.
let Since = datetime(2026-10-02T00:00:00Z);
DeviceNetworkEvents
| where Timestamp > Since
| where isnotempty(RemoteUrl)
| where RemoteUrl matches regex @"(?i)pharma[-_.]?digital|REPLACE_WITH_YOUR_PORTAL_PATTERN"
| where not(RemoteUrl matches regex @"(?i)(^|[/.])akp-pharma-digital\.com([/:]|$)")
| summarize Connections = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
    Processes = make_set(InitiatingProcessFileName, 5)
    by DeviceName, RemoteUrl
| order by FirstSeen asc
| take 500

3. The same mail search in Splunk. Splunk Add-on for Microsoft Office 365, message trace input, sourcetype o365:reporting:messagetrace. Replace the index.

index="REPLACE_WITH_O365_INDEX" sourcetype="o365:reporting:messagetrace" earliest="10/02/2026:00:00:00"
| eval sender_domain=lower(mvindex(split(SenderAddress, "@"), 1))
| where match(Subject, "(?i)pharma ?digital|ファーマデジタル|医薬情報ネット|REPLACE_WITH_YOUR_PORTAL_NAME")
| where NOT match(sender_domain, "(^|\.)(asahi-kasei\.co\.jp|akp-pharma-digital\.com|pin-japan\.com|pin-japan\.co\.jp)$")
| stats count AS messages dc(RecipientAddress) AS recipients min(_time) AS first_seen max(_time) AS last_seen BY SenderAddress Subject Status
| convert ctime(first_seen) ctime(last_seen)
| sort 0 first_seen

Download the examples: mail KQL · device KQL · Splunk SPL.

Other platforms. The same idea in Sumo Logic, for DNS or proxy logs: replace the source category. Lines that also contain the official domain are excluded, so review them separately.

_sourceCategory="REPLACE_WITH_DNS_OR_PROXY_SOURCE_CATEGORY" *pharma*digital* NOT "akp-pharma-digital.com"
| count by _sourceCategory, _sourceHost
| sort by _count

In CrowdStrike Falcon (LogScale / Next-Gen SIEM), DNS requests from endpoints:

#event_simpleName=DnsRequest
| DomainName=/pharma[-_.]?digital/i
| DomainName != *akp-pharma-digital.com
| groupBy([DomainName, aid], function=count())

No result does not prove nothing was sent: logs may be missing or out of retention, mail to personal addresses is invisible, and lures may not name the site at all. EmailEvents · EmailUrlInfo · DeviceNetworkEvents

Copy-paste templates

Replace everything in [square brackets]. Have Legal or Privacy review anything that leaves the company.

Questions for your HCP-portal or marketing vendor

Subject: [Company] – questions following the Pharma DIGITAL incident

Dear [vendor contact],
Following the 6 October 2026 notices by Asahi Kasei Therapeutics and 医薬情報ネット about Pharma DIGITAL, please answer the following in writing by [date]. Questions 1 and 2 apply even if you are a different company, because platforms, hosting and subcontractors are often shared.
1. Do any systems, databases, hosting accounts, administrators or subcontractors that process our data also serve Pharma DIGITAL or 医薬情報ネット?
2. Has any data about our HCP members, our employees or our campaigns been affected, or is this still being assessed?
3. Which of our datasets do you hold (HCP members, seminar registrants, KOL or targeting data, employee profiles and photos), with record counts and retention periods?
4. How do administrators reach the member database, and is multi-factor authentication enforced for every administrative and hosting account?
5. When were the member site and database last tested for vulnerabilities, and have all high-risk findings been fixed?
6. Which logs do you keep for administrator sign-ins, database queries and data exports, and for how long?
7. How are member passwords stored, if at all?
8. Within how many hours would you notify us of suspected unauthorized access, and through which verified channel?
9. Which credentials or integrations connect your systems to ours (single sign-on, CRM sync, API keys), and when were they last rotated?
10. Who is responsible for security incidents on our account, and what is their out-of-hours number?
Kind regards,
[Name, title, department]

Script for MRs and the medical information centre

If a healthcare professional asks about the Pharma DIGITAL incident:
- "Pharma DIGITAL is operated for Asahi Kasei Therapeutics, not for [our company]. [We have not been informed of any impact on our services / We are checking with our own vendors and will tell you if anything affects you]."
- "Please be careful with messages about seminars, site re-registration or incident follow-ups that contain links, ask for a password, or come from an address you do not recognise."
- "Our official sites are [list of domains]. We never ask for your login password by email or phone. To check that a message is really from us, call [main number on our corporate website]."
Record: the HCP's question, any suspicious message they describe (sender, subject, date), and pass it to [security contact].
Do not: speculate about the cause, forward suspicious messages to other doctors, or promise anything about another company's incident.

Five-line briefing for management

1. What happened: the vendor that runs Asahi Kasei Therapeutics' HCP site Pharma DIGITAL found unauthorized access to its member database; data on up to about 514,000 HCPs and 700 employees may have been viewed or taken (disclosed 6 Oct 2026).
2. Our exposure: [we do / do not use 医薬情報ネット]; [our HCP-facing vendors have / have not yet confirmed no shared systems].
3. Expected risk to us: phishing and impersonation aimed at doctors using pharma themes, including possibly our brand and staff.
4. Actions under way: vendor questions sent [date]; MR and medical information script issued; mail and DNS hunting running; official-domain page [published / planned].
5. Decisions needed: [e.g. publish an official-domain page; require DMARC enforcement on campaign domains; vendor audit of HCP portals]. Next update: [time].

What remains unknown

How the attacker got in, and when access began. Only the confirmation date, 2 October, is public.
Whether data was copied or only viewable. The notices say "may have been viewed or taken".
Whether the HCP groups overlap, and which other fields the word "etc." covers. For example, are login IDs or password hashes stored?
Whether other services run by the same vendor, or data it holds for other companies, were reachable from the same systems. None of the other 23 drug companies PIN lists as clients has said either way.
Why employee photos were in the member database, and whether the employees were notified directly.
When the member area reopens, and whether members will have to reset passwords or register again.

Sources and updates

9 October 2026, about 10:45 JST: Pharma DIGITAL now serves a limited temporary site with no login; no follow-up from Asahi Kasei Therapeutics, PIN or JMDC; no notice from other PIN clients found in news searches. Added the JPCERT/CC alert of 8 October and a link to our 60-day review.

7 October 2026, about 11:45 JST: added the status of all 24 drug companies PIN lists as clients (only Asahi Kasei Therapeutics has published a notice), PIN's shareholder and certification, the new inquiry number and PIN's statement to the trade press.

7 October 2026: first published. The notices, the vendor's website and the Pharma DIGITAL maintenance page were checked early on 7 October (JST). We will update this analysis if the companies publish the cause or a final scope.

30-second briefing