M3 MR-kun breach leaks doctor names and workplaces

M3's MR-kun service leaked data on doctors and pharma staff

Someone broke into the system behind MR-kun, a service M3 runs, and personal data on physician members and pharmaceutical company staff got out. M3 posted an apology and an outline of the incident on its corporate site on October 15. The notice is in Japanese only.

M3 says it has found no sign that the leaked data was made public or misused so far. It is still looking into the details and plans to publish updates if it learns more.

The incident at a glance (from M3's notice)

Item	Detail
Break-in found	October 14, 2026 (Wednesday)
Announced	October 15, 2026
Service	MR-kun, M3's service for pharmaceutical companies
People affected	Some physician members (fewer than 10% of all) and pharmaceutical company staff (several hundred)

Japan has seen a run of breach disclosures this autumn. Earlier cases are listed in Japan data breach list: cases by date and cause.

M3 found the break-in on October 14

M3 noticed the unauthorized access to the MR-kun system on Wednesday, October 14. By the end of that day it had also found that information on some physician members and pharmaceutical company staff had leaked. It went public the next day.

MR-kun is M3's drug promotion service

MR-kun is a drug promotion service that M3 runs for pharmaceutical companies. The "MR" stands for medical representative, the drug company employee whose job is to give doctors information about medicines.

M3 also runs m3.com, a members-only site for healthcare professionals. Its service page says m3.com has more than 250,000 physician members, and the notice sends members with questions to m3.com customer support.

Names and workplaces leaked, but not passwords or m3 points

The leaked data includes names, workplaces and, for some people, email addresses. Login passwords and m3 points were not part of it. Here is how the items break down.

What leaked and what didn't (from M3's notice)

Type	Items
Leaked	Names, workplaces, some email addresses, among other items
Not leaked	Login passwords, m3 points held by members, among other items
Never held by M3	Credit card numbers and similar data

M3 says it never held credit card numbers in the first place. Email addresses were exposed only for some of the people affected, not for everyone.

Fewer than 10% of physician members are affected

M3 puts the affected group at fewer than 10% of its physician members, plus several hundred pharmaceutical company staff. Both figures are rough numbers from the announcement, not a final count.

Update: In its second report on October 23, 2026, M3 said it had confirmed that personal information of 25,775 m3.com members and others and 2,260 pharmaceutical company staff was leaked. Email addresses were included for 6 of the members and 264 of the pharmaceutical company staff (per M3's second report).

M3 is still working out exactly how many people are affected and what data was accessed, and says it will share more once it knows. Until then, there is no way to tell from news reports whether a particular person is on the list.

M3 blocked the access routes it found

After spotting the break-in, M3 shut the access routes it had identified and has kept watching its systems since. It tightened its defenses while it worked out how far the breach reached, and plans to strengthen protection across its other services too.

The cause is still unknown. All M3 has confirmed is that a third party got in without permission. It has not said how the attack worked or where the attackers entered.

Affected people will be contacted in turn

M3 will contact the people affected in turn. For pharmaceutical company clients, M3's own account staff will make the contact.

The company is also reporting the incident to the supervising authorities. Anyone wondering whether they are affected will need to wait for that message from M3.

Watch for messages pretending to be from M3

M3 is warning members and clients about suspicious emails, text messages and phone calls that claim to come from M3. A message that gets your name and workplace right can still be fake. M3 asks people to get in touch in either of these cases.

• You receive a suspicious email, text or call that says it is from M3
• You notice activity on your account that you don't recognize

Members should contact m3.com customer support

Members with questions should go to m3.com customer support. The form is on the m3.com contact page. Other groups have their own contacts, listed below.

Contacts for this incident (from M3's notice)

Who	Contact
Members	m3.com customer support
Pharmaceutical clients	M3 account staff will reach out
Shareholders and investors	IR (info-ir@m3.com)
Press	PR (pr@m3.com)

What workplaces can learn from the M3 breach

Companies that hold customer or client data should review their defenses, and staff should get ready for fake messages. On October 9, Japan's Ministry of Economy, Trade and Industry (METI) warned businesses that data leaks caused by unauthorized access keep happening at Japanese companies and organizations.

Companies should check vulnerability handling and leadership

If your company holds data on customers or partners, check whether it is doing the three things METI asked for. The ministry asked businesses for:

• Leadership from the top of the organization
• Early awareness of vulnerability information, and a quick response to it
• A move to "zero trust" security

M3 has not yet said how attackers got in. That makes the basics a better place to start than any one attack method.

Staff should not click links in leak-themed messages

Employees should not click links in emails or texts that use a data leak as a hook. Phishing means messages that pretend to come from a real company to lure you to a fake site and get you to type in your details. Japan's National Police Agency (NPA) says many phishing messages use urgent phrases such as "personal information leak" or "unauthorized access detected."

Some phishing emails even spoof a real company's address, so the sender line alone won't tell you whether a message is genuine. The NPA advises reaching the real site through a bookmark you saved earlier or through the company's official app.