Medica Shuppan Ransomware Attack (About 641,000 People): What Medical Readers, Authors and Publishers Should Do

The company says it is contacting people who were or may have been affected individually, in stages. It also says that where direct notice is difficult, publication on its website takes its place.

Medica ID users, buyers of its books and journals, seminar attendees, authors and lecturers, people at hospitals, facilities and organizations that outsourced work to it, and its employees and job applicants may be in scope even without a notice. To check, contact the Medica Shuppan customer center (0120-276-115 or 06-6398-5008 in Japan, 9:00–17:00, closed weekends and holidays). Use the number from the company's official website, not one written in an email.

On May 1, the company warned that emails impersonating it had been seen. They say things like "there was unauthorized access", "your personal data may have leaked" or "you need to reset your password", and lead to a page asking you to enter personal information.

The company says it never asks for personal or confidential information to be entered or confirmed by email, and that personal information can only be entered on its official site. Even when the sender field shows an address on the company's own domain, the company says the emails were not sent by it. The sender field is not proof of anything (see What is phishing?).

The sample fake email the company published listed login passwords and part of credit card data among the information that may have leaked. The real notices say the opposite: Medica ID passwords are managed separately and could not have leaked, and its online sales system does not hold credit card data.

An email that lists leaked items contradicting the official notices and rushes you into a procedure is reason enough for suspicion.

When a list of medical professionals is at risk, fake messages need not be "leak notices". Everyday pretexts for healthcare workers are plausible (this site's assessment):

• subscription renewals
• online seminar invitations
• academic society registration or training credit (points) procedures
• invoices for study materials

For these too, don't use the link or the phone number in the message; check through the organizer's official site that you open yourself, or through the relevant department at your workplace. If it arrived at your work address, share it with your hospital's or facility's IT staff so colleagues who get the same fake email are less likely to fall for it.

Author and contractor data includes bank account numbers. A major Japanese bank warns that if a third party learns your PIN in addition to your account number, it can lead to unauthorized withdrawals via online banking, and says it never asks for a PIN over the phone or has you enter it through automated voice guidance. The Japanese Bankers Association likewise says it never asks for PINs or passwords.

Do not respond to messages that, under the name of "confirming the account for your manuscript fee" or "processing your honorarium", ask for a PIN, online banking ID and password or a one-time password. Turn on transaction alerts in online banking or your bank's app, and contact your bank if you see a transaction you don't recognize.

My Numbers are included only for authors and contractors who registered them. A My Number normally never changes, but under Article 7(2) of the My Number Act, when it is found that the number has leaked and may be used improperly, the mayor can assign a new one, for example at your request. First confirm with the company's desk whether your data is in scope, then consult the municipality where you are registered as a resident if needed.

Medica ID passwords are said not to be at risk, but the company recommends changing them regularly. If you use the same password elsewhere, change it (see choosing a password manager). In Japan, these public desks can help:

• Fake emails: forward them to the Council of Anti-Phishing Japan
• Technical worries, such as having entered information or a device you are unsure about: the IPA Information Security Safety Consultation Desk (03-5978-7509, 10:00–17:00, closed weekends, holidays and New Year)
• Fraud or concerns about it: the police consultation line #9110

The March 17 notice said the company was announcing publicly first because it could not even access its list of contacts. When ransomware stops business systems, the very list you need to notify affected people individually can become unusable.

Keep contact details for partners, authors and key customers in a backup separated from the business network (offline or under separate management), and regularly test that it can actually be restored (see backup essentials (the 3-2-1 rule)).

The company says the starting point was a third party entering its internal network using legitimate account credentials. If even one entry point — a VPN (for connecting to the internal network from outside), remote desktop, a cloud admin console — accepts a password alone, it becomes the weak point for everything.

The first step is to list every entry point reachable from outside and check that multi-factor authentication applies to each. The company, too, lists strengthened ID authentication and security among measures taken, and strengthening its authentication platform to prevent unauthorized logins among planned ones. Cases of the same type are collected in 2026 breaches that ran on legitimate credentials.

The third report's items show that readers' contact details, authors' account numbers and My Numbers, entrusted health checkup results and employee evaluations all fell within the scope of the same attack.

Keep My Numbers needed for tax paperwork and account numbers used for payments in a separate place with separate access, and delete data once payments are done and it is no longer needed. If data is kept apart, a break-in at one place exposes fewer kinds of data.

Also, as a defense against fake emails using your domain, review SPF, DKIM and DMARC, which makes it easier to tell customers how to recognize your real emails.