Cyber Incident Victim: Kokikai Yasue Hospital
Date:
Jul 2022
Location:
Japan
Summary
Unauthorized access to Kokikai Yasue Hospital's internal computer systems potentially compromised personal and medical data of 111,191 patients alongside information from 715 employees. The exposed patient records included names, dates of birth, contact details, medical histories, treatment specifics, and COVID-19 vaccination histories. Employee data details were not explicitly specified in available reporting. The incident, suspected to involve ransomware based on initial analyses, resulted in significant data leakage but did not disclose operational disruption specifics or confirmed threat actor attribution.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On July 4, 2022, Kokikai Yasue Hospital in Gifu City, Gifu Prefecture, Japan, publicly disclosed a significant data breach involving unauthorized access to its internal computer systems. The incident potentially exposed the personal and medical information of 111,191 individuals, including both patients and recipients of COVID-19 vaccinations administered by the facility. Compromised data categories included full names, dates of birth, residential addresses, telephone numbers, and detailed medical histories encompassing treatment records and pre-existing conditions. Vaccination status and related COVID-19 immunization details were also confirmed as part of the leaked dataset. Additionally, personal information belonging to 715 hospital employees was similarly compromised, though specific details about the employee data elements were not elaborated in available reporting. The hospital did not specify the exact timeframe during which the unauthorized access occurred or the duration of potential exposure prior to detection.
The breach represented a substantial compromise of highly sensitive health information given the inclusion of diagnostic histories, treatment protocols, and immunization records. Medical data of this nature carries significant privacy implications under Japanese personal information protection laws and international healthcare data standards. While the hospital acknowledged the potential leakage, no specific information was provided regarding the technical vector of intrusion, whether data was exfiltrated or merely accessed, or any operational disruptions to clinical services. The announcement did not confirm whether ransomware deployment or encryption of systems occurred, despite external speculation characterizing the incident as a possible ransomware attack. No threat actor group claimed responsibility for the intrusion in publicly available reporting at the time of disclosure. The hospital did not release details about containment measures, forensic investigations, or notification timelines for affected individuals beyond the initial public statement.