Entouch: ransomware attackers got into the database of its remote detailing service for drug makers; names and hospitals of healthcare workers leaked

1. 2026-10-13

   At about 4 p.m., Entouch found that remote detailing data had left a database it manages. The cause was unauthorized access by a ransomware group, and the leak was confirmed. [1]

2. 2026-10-19

   The parent company, TOHO HOLDINGS, disclosed it. [1] [2]

• Names, medical institutions and prefectures of the healthcare workers who used the service [1]
• Names and email addresses of administrators and drug company reps (including eMRs) who log in to the platform [1]
• Phone numbers and email addresses entered as booking contacts, the product and drug company of each booking, booking and meeting times, and meeting status [1]

The count and scope are still being checked. Presentation files and recordings are not in this database and are not affected. No data was altered or deleted, and the business continues. The group says Entouch's systems are fully separated from its other systems, which are not affected. [1] [3]

Entouch patched the software that accesses the database, preserved the access logs and forced a change of all passwords. It consulted the Tokyo Metropolitan Police and reported to the Personal Information Protection Commission. A forensic firm is investigating the cause and scope. [1]