Asahi Kasei Therapeutics healthcare-professional site breach (about 514,000 people): what may have leaked and what doctors, pharmacists and nurses should do

The data that may have leaked includes names, facility names, facility addresses, job types and specialties. Together, these let someone write a convincing fake email with your correct name, workplace and specialty.

The company asks people not to open URLs in suspicious emails, and not to open attachments or enter personal data. Even if an email talks about "re-registering your membership", "our apology" or "the site has reopened", do not click; go in from your usual bookmark (how to spot fakes: What is phishing?).

Healthcare professionals routinely receive invitations to drug-company seminars and webinars, academic society events and paid surveys. With this data, a fake can be tailored to your own specialty.

If an invitation asks for an ID, password or medical license number to register or watch, do not use the email link. Open the official website of the company or society yourself and check that the same event is listed there.

The notice does not list passwords among the data that may have leaked, but it does not say they were unaffected either. Each drug company runs its own site for healthcare professionals, so these are exactly the kind of sites where people reuse one password.

If you used your Pharma DIGITAL password on other medical sites, hospital systems or your email, change it there to a separate one (how to manage them: How to choose a password manager; how to check: How to check if your password has leaked).

On a site that only asks for a password, typing it into a fake site is enough for someone to get in. If the medical sites and email you use often have a two-step verification option (an extra check at sign-in, such as an app on your phone), turn it on.

Not every site offers it. For which method to choose, see Choosing MFA the right way.

The company has set up a dedicated contact point. Its phone number changes from October 8, so use the number in the company's notice (Japanese), not one written in an email you received.

Tell physicians, pharmacy and nursing staff to be careful with emails claiming to be from drug companies, academic societies or seminar organizers. Always include where to forward suspicious emails (for example, one IT department address).

Collected reports show how many people in the hospital got the same fake, and let you block the sender for everyone at once.

Most mail servers and email services can add an "External" label to the subject or top of messages that come from outside. Even an email using a real drug-company employee's name then shows at a glance that it came from outside.

Also check that mail failing sender-domain authentication (SPF, DKIM, DMARC) is sent to the junk folder.

If the password for the electronic medical records, VPN or hospital email is the same as on a medical information site, a password typed into a fake site becomes a way into the hospital. Ask staff never to use internal-system passwords on outside sites, and set up multi-factor authentication on the VPN and email (choosing a method: Choosing MFA the right way).