For: doctors and other healthcare professionals who use m3.com, pharmaceutical company staff who work with MR-kun, and front-desk or IT staff at medical institutions. This article is based on the official announcements of M3, Inc. (first and second notices) and does not cover attack or scam techniques.
Developing: this article will be updated as the organisation publishes more
As of October 27, 2026Not yet known
- The cause and details of the access route
- What exactly the service-use information and assignment relationships include
- How many of the 25,775 are doctors who are not m3.com members
- How many pharmaceutical companies are affected
- The specific measures to prevent a recurrence
In its second notice of October 23, M3 says it will continue investigating and will promptly announce any new facts. It does not give a date. When we checked the company's news list on October 27, there was no update after the second notice.
What doctors and other m3.com users should do today
Do not open links in messages claiming to be from M3 or a pharmaceutical company
M3 asks people to watch out for suspicious emails, text messages and calls impersonating the company. The leaked data includes names and workplaces, plus the assignment relationships that client pharmaceutical companies had registered.
In general, this combination lets someone write a message that names a real pharmaceutical company, or even the company that covers you. Whether it is about a lecture or webinar, a survey reward, points, or an apology for the breach, do not open the link; open m3.com from your bookmark or the official app instead (how to spot fakes: What is phishing?).
Check requests from a representative using new contact details
Messages such as "your representative has changed", "I am writing from a new address" or "please view the materials on another site" cannot be trusted just because the name and company are right. Check with the representative through the channel you normally use, or contact the pharmaceutical company's main number yourself.
Do not give out passwords, card numbers or bank details
M3 says its individual messages will never ask you to enter or provide a password, credit card details or bank account details. Treat any message asking for these as suspicious, even if it claims to be from M3.
Tell your front desk and office staff to watch for messages that name you
Of the 25,775 members and others, email addresses were included for only 6. Workplaces were included, however, so in general someone could call, email or write to a hospital or clinic's main contact using a doctor's name. A short word to reception and office staff, asking them to check unfamiliar requests from M3 or a pharmaceutical company with you before passing them on, makes this harder.
Use the contact in the company's notice
The member contact in M3's second notice is m3.com Customer Support at cs-security@m3.com (the first notice pointed to the m3.com contact page). Do not use contact details from an email or text you received; open the notice from the company's news list instead.
M3 has not asked you to change your password
Login passwords were not included, and the company has not asked members to change them. If you use the same password for m3.com and other medical information sites or hospital systems, this is a good time to separate them, which also protects you from future fake sign-in pages (How to choose a password manager).
What pharmaceutical company staff should do
Leaks were also confirmed for 2,260 pharmaceutical company staff: name, workplace, email address for some and other items (email addresses for 264).
Tell your security team your company is affected
M3 says its staff are contacting affected pharmaceutical companies. Check with the relevant internal team whether your company has been contacted, and if so, agree where staff should report suspicious messages claiming to be from business partners or doctors.
Check unusual requests that claim to come from M3 or a doctor
In general, a name, workplace and email address together make it easier to send fake invoices, links to sign-in pages or attachments that appear to come from a business partner. If a message claiming to be from M3 staff or a medical institution asks you to change bank details or sign in on a new site, check with the sender through your usual channel.
Point doctors who ask to M3's official contact
If a doctor asks whether they are affected, do not guess; point them to the company's notice and member contact. If your company contacts doctors itself, do not ask them to enter passwords or personal details, so your message is not confused with a fake one.
What happened (according to M3)
M3, Inc. published "Apology and notice regarding a personal information leak caused by unauthorized access" on its corporate news page on October 15, 2026, and a second notice on October 23. Everything below comes from the company's announcements.
October 14, 2026
M3 confirmed unauthorized access by a third party to the system of MR-kun, a service it runs for pharmaceutical companies. The same day it confirmed that information on some members and pharmaceutical company staff had leaked, and cut off the access route it had identified.October 15
First notice. It described those affected as "some physician members (less than 10% of all physician members)" and "pharmaceutical company staff (in the hundreds)", and said the numbers and details were still being examined.October 22
M3 began contacting affected members individually at their registered email addresses.October 23
Second notice. It gave the confirmed numbers as 25,775 m3.com members and others and 2,260 pharmaceutical company staff, and said the route(s) identified so far used to obtain the data had been contained.
- Affected system
- The system of MR-kun, a service M3 runs for pharmaceutical companies
- m3.com members and others
- Name, workplace, email address for some, some information about their use of M3 services, and information client pharmaceutical companies had registered in the service (such as assignment relationships): 25,775 people (email addresses for 6)
- Non-members
- Includes some doctors who are not m3.com members, whose details pharmaceutical companies had entrusted to M3 (no breakdown given)
- Pharmaceutical company staff
- Name, workplace, email address for some and other items: 2,260 people (email addresses for 264)
- Not included
- Login passwords and m3 points. M3 does not hold credit card numbers
- Public posting or misuse
- None found so far
- What M3 did
- Cut off the identified route and strengthened defences, contained the route(s) identified so far used to obtain the data (completed), reported to the supervisory authorities, emailed affected members individually (from October 22), and is contacting affected pharmaceutical companies through its staff
- Cause
- Not published
What changed between the first and second notices
The description of those affected changed from "some physician members (less than 10% of all physician members)" to "m3.com members and others", and the second notice adds that some doctors who are not m3.com members are included. Pharmaceutical company staff went from "in the hundreds" to 2,260. "Information about use of M3 services" and "assignment relationships" were added to the leaked items, and the member contact changed from a contact page to an email address (cs-security@m3.com).
What is known and what is not
Based on the company's notices of October 15 and October 23, as of October 27, 2026. We will update the status column as new information is published.
| Item | What the notices say | Status |
|---|---|---|
| Name and workplace (members and others, pharma staff) | Listed as confirmed leaked | Leak confirmed (M3) |
| Email address | 6 members and others, 264 pharma staff | Leak confirmed (M3) |
| Information about use of M3 services | "Some information about use of M3 services". Specific items not given | Leak confirmed (M3) |
| Assignment relationships | Registered in the service by pharmaceutical companies. Specific items not given | Leak confirmed (M3) |
| Login passwords, m3 points | Not included | Not included (M3) |
| Credit card numbers | Not held by M3 | Not included (M3) |
| Phone number, home address | Not on the list of leaked items | Not stated |
| Number of people | 25,775 members and others, 2,260 pharma staff (people for whom any item was confirmed leaked) | As of October 23 (M3) |
| Number of non-member doctors | Only stated that some are included | Not stated |
| Cause and route | Under investigation in the first notice; not described in the second | Under investigation |
| Public posting or misuse | None found | Not found (M3) |
| Individual notices | Members by email from October 22; pharmaceutical companies through M3 staff | Confirmed (M3) |
"Not stated" does not mean "not leaked"
Phone numbers and addresses simply do not appear on the list of leaked items. What M3 explicitly says was not included is login passwords, m3 points and credit card numbers. The notices also do not say what the service-use information or assignment relationships contain, so we show these statuses separately.
What names, workplaces and assignment data can be used for
In general, when a healthcare professional's name and workplace are known together with which pharmaceutical company covers them, the following can happen. (No such misuse has been announced in this incident; M3 says it has found none.)
Name + workplace + assignment
25,775 m3.com members and others
↓→
Calls or letters to the workplace posing as a real company or representative
→ Check with the person through your usual channel
Name + workplace + email
264 pharma staff, 6 members and others
↓→
Emails posing as M3 or a business partner, leading to sign-in pages or attachments
→ Do not open links; use your bookmark
What can happen in general
- Posing as a real pharmaceutical representative and moving you to new contact details because of a "change of representative"
- Lecture, survey-reward or points messages that lead to a fake sign-in page
- Fake "breach apology" messages asking for bank details or passwords
- Calls to a hospital front desk asking to be put through to a named doctor
What you can do
- Open m3.com from your bookmark or the official app
- Check representatives' messages through your usual channel
- Do not give out passwords or bank details in response to a message
- Ask front-desk and office staff to watch for unfamiliar requests that name you
In the same month, the Asahi Kasei Therapeutics healthcare-professional site breach was also announced, in which healthcare professionals' names, workplaces and specialties may have leaked. It is a different incident with a different organisation and cause, but the way to prepare for fake messages aimed at healthcare professionals is similar.
M3's October 21 notice is a separate incident
On October 21, 2026, M3 announced that unauthorized access to an outside cloud service it used to run the M3PSP service site and the 1-person-1-yen fund website may have leaked information submitted through those sites' inquiry forms (271 people for M3PSP, 127 for the fund). M3 says it found no unauthorized access to its own systems in that case. It is a separate announcement from MR-kun.
For pharmaceutical companies that register doctors' details with outside services
The cause has not been published. This section is limited to what the published leaked items show (general points to review, not a guess at the cause).
List what you have registered with outside services
According to the second notice, the leaked data included assignment relationships that pharmaceutical companies had registered in M3's service, and details of non-member doctors that pharmaceutical companies had entrusted to M3. In general, information you register in an outside service can be exposed somewhere other than your own systems. Keeping a list of which services hold which doctors' details, and which items, lets you explain the impact quickly when a provider reports an incident.
Delete registrations you no longer need
Regularly check for doctors you no longer cover and facilities you no longer work with, and delete what you do not need. Data you do not hold cannot leak.
Decide in advance how to answer doctors after an incident notice
M3 says its staff are contacting affected pharmaceutical companies. Decide internally how representatives should answer questions from doctors and which official contact to point them to, so that nobody answers by guessing and your messages are not confused with fake ones.
Sources (public record)
The facts in this article are based on the public information below. We do not speculate about the cause or attack methods, which have not been published.
- M3, Inc., "Apology and notice regarding a personal information leak caused by unauthorized access" (Japanese, October 15, 2026) — corporate.m3.com (PDF)
- M3, Inc., "Apology and notice regarding a personal information leak caused by unauthorized access (second notice)" (Japanese, October 23, 2026; checked October 27) — corporate.m3.com (PDF)
- M3, Inc., notice on a possible leak from the M3PSP service site and the 1-person-1-yen fund website following unauthorized access to a cloud service it uses (Japanese, October 21, 2026; separate incident) — corporate.m3.com (PDF)
- M3, Inc. news list — corporate.m3.com/news
Update history
2026-10-27: First version, based on M3's first notice of October 15 and second notice of October 23. We will update it when further details such as the cause are published.
Read next
- Other healthcare data incidents this month: Asahi Kasei Therapeutics healthcare-professional site breach / Unauthorized access to Medley's at-link clinic system
- Spotting fake messages: What is phishing?
- Protecting your sign-in: How to choose a password manager / Choosing MFA the right way
- Healthcare incidents: Hospitals whose care was halted by cyberattacks in 2026
- Other 2026 incidents: Data breaches and cyberattacks of 2026