Asahi Kasei data breach may expose personal data

Asahi Kasei data breach began at a third party vendor

The breach did not start inside Asahi Kasei Therapeutics but at Iyaku Joho Net, the contractor that runs Pharma DIGITAL and manages its data. Pharma DIGITAL gives medical professionals in Japan information on the proper use of the company's prescription drugs, along with information on medicine and healthcare. Asahi Kasei Therapeutics is the drug business of the Asahi Kasei group and went by the name Asahi Kasei Pharma until April 1, 2026.

Third party vendor reported the security breach on October 2

Iyaku Joho Net reported on October 2, 2026 that a cyberattack had reached the member database linked to the site. Asahi Kasei Therapeutics took Pharma DIGITAL offline at once, and the site is still offline.

The public disclosure followed four days later, on October 6, with an apology to the healthcare professionals who had registered on the site. According to that notice, personal data in the database may have been viewed or taken.

Personal data of healthcare professionals in three groups

Asahi Kasei Therapeutics lists the people at risk in three separate rows, two for healthcare professionals and one for its own staff. The figures are maximums.

The company says it never stored credit card data or "special care-required personal information." That is a legal category under Japan's privacy law covering details such as medical history and beliefs, which need extra care because they can lead to discrimination.

Why data breach totals differ for healthcare professionals

The official table has no total, and it does not say whether the 44,000 are part of the 514,000. English-language reports from AliasFleet, DEV Community and BigGo Finance headline "up to 558,700 people," and PHARMA JAPAN uses 560,000. The three rows add up to 558,700, so that figure treats the groups as separate people.

Until the company says otherwise, the safest reading is its own three-row breakdown. Up to about 514,000 healthcare professionals had their names and workplaces in the database, and some of them also had an email address on file.

Security breach cause still unknown, Asahi Kasei says

Asahi Kasei Therapeutics has not said how the attackers got in. It is investigating the cause and scope with Iyaku Joho Net and outside specialists, and it has reported the incident to the authorities.

The company says the route used in the attack has already been closed and that no further access has been found. It also says no misuse of the leaked data or other damage has been confirmed so far.

Once the investigation ends, it plans to tighten oversight of its contractors and review how it protects personal data. The setup differs from the infoQ breach, where attackers broke into the operator's own site (infoQ data breach exposes up to 948,498 records).

Phishing email risk for healthcare professionals

Anyone registered on Pharma DIGITAL should treat messages that claim to come from Asahi Kasei Therapeutics or Iyaku Joho Net with suspicion. The company warns that the leaked data could be used for impersonation and lists three things to avoid. Do not open links in suspicious emails, do not open attachments, and do not type in personal information.

The company will contact affected healthcare professionals one by one by email and other means. If an email claims to be that notice, check it against the company's own website instead of following a link in the message. Aflac set up a similar helpline for suspicious contacts after its own breach (Aflac data breach in Japan hits 4.4M customers).

Who to contact about the data breach or a phishing email

Questions about the breach go to a security incident desk run by Iyaku Joho Net. From October 8 the phone number is 0120-88-2566, replacing 03-6381-5788, and the desk also takes email at security_team@pin-japan.com. These are Japanese domestic numbers.

The Asahi Kasei data breach came from a contractor's member database, and the company is still working out how it happened. Until it publishes the results, the practical step for registered users is to be wary of any message that uses the breach as a reason to click.