株式会社ホスピタルサービス

Summary

A medical services company identified a ransomware infection on its network after detecting external unauthorized access. The organization promptly isolated affected servers from the network to prevent further spread and engaged external cybersecurity specialists to support recovery efforts, while also coordinating with investigative authorities. Operations such as order processing and logistics are progressively returning to normal. At the time of disclosure, no evidence of personal data leakage had been confirmed, though investigations into potential personal information exposure remained ongoing.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On May 15, 2025, 株式会社ホスピタルサービス (Hospital Service Co., Ltd.), a company operating in medical-related services, identified that servers within its internal network had been infected with ransomware following unauthorized external access. The company recognized the intrusion on the same day the compromise was detected and promptly moved to contain the situation. In line with standard incident response practices, the organization immediately took measures designed to prevent the further spread of the attack across its environment. Once these initial containment steps had been executed, the company publicly disclosed the incident.

Following the discovery, 株式会社ホスピタルサービス established a dedicated response structure, setting up a headquarters-level incident response office (本部対策室) to coordinate recovery operations. The company engaged external cybersecurity experts to assist with the technical investigation, remediation, and restoration efforts, and began working in cooperation with law enforcement authorities, providing updates as the inquiry progressed. As part of the containment strategy, the organization disconnected servers that were potentially affected from the corporate network, isolating them to limit lateral movement and further damage. The company also performed network segmentation and shutdown procedures to halt ongoing malicious activity and to create a controlled environment in which forensic analysis could be conducted.

The incident directly affected 株式会社ホスピタルサービス's operational capabilities, particularly in the areas of order receipt, order processing, and logistics (受発注業務や物流体制). In the immediate aftermath of the ransomware infection, these functions were disrupted as the company worked to contain the attack and assess the extent of the damage. However, the organization reported that recovery efforts were progressing and that the impacted business processes were gradually returning to normal operations. The company's communications emphasized that the response was being carried out methodically, with the dual priorities of restoring service and preserving the integrity of any evidence needed for investigation.

Regarding the potential compromise of sensitive information, 株式会社ホスピタルサービス stated in its follow-up report dated May 22, 2025, that an investigation into personal information was still ongoing. At the time of that report, the company had not confirmed any actual leakage of personal data as a result of the ransomware attack. It should be noted, however, that the absence of confirmed leakage at the time of disclosure did not constitute a definitive conclusion; rather, it reflected the preliminary status of the forensic review, which was being conducted in collaboration with external specialists to determine the full scope of any data exposure.

The company's public statements, both in the initial disclosure following the May 15 detection and in the subsequent May 22 update, reflected a measured and transparent approach. The organization acknowledged the seriousness of the incident, expressed regret for the inconvenience and concern caused to its stakeholders, and committed to providing further information as the investigation advanced. By the date of the second report, the immediate crisis response had transitioned into a longer-term recovery and investigation phase, with the company indicating that it would continue to coordinate with external experts and investigative authorities and would issue additional announcements should any material developments warrant public disclosure.

Sources

Sources available to members: 2 sources.