Toho Holdings breach: EnTouch remote detailing data exposed after ransomware access

The Toho Holdings breach centered on its non-consolidated subsidiary EnTouch KK. A third party accessed and removed records from the remote detailing database data.entouch.jp around October 9, 2026. Company filings released on October 19, 2026, confirm the incident remained limited to EnTouch systems with no evidence of data alteration or operational shutdown.

What Happened in the Toho Holdings Breach

EnTouch provides remote communication tools that let pharmaceutical and medical device companies schedule and document meetings with healthcare providers. The affected database handled appointment booking, status tracking, and basic user administration for these services. Discovery of the access occurred on October 13, 2026, at approximately 16:00 JST, after the ransomware group Black X publicly listed the company as a victim several days earlier.

Toho Holdings stated that the breach did not extend to other group companies. The parent maintains a roughly 33 percent stake in EnTouch. No content files or recorded video and audio sessions were involved. The company immediately applied security patches, preserved logs, reset all passwords, and contacted the Tokyo Metropolitan Police Cybercrime Division along with Japan’s Personal Information Protection Commission.

External forensic investigators were engaged to determine the entry point and full scope. Customers received advice to monitor email accounts for suspicious messages. Toho Holdings indicated that additional facts would be published as the investigation progressed, with no confirmed instances of data misuse reported through October 24, 2026.

Data Types and Scope of Exposure

The exposed records included names of healthcare professionals, their affiliated medical institutions, and prefecture information. Platform administrator and eMR user details such as names and email addresses were also present. Reservation contact information, including phone numbers and emails, along with product names, pharmaceutical company identifiers, and meeting dates, times, and status flags appeared in the dataset.

Exact record counts remain under review and have not been released publicly. The company noted that the investigation continues to clarify the precise volume and any additional fields that may have been taken. No evidence of broader network compromise or lateral movement beyond the EnTouch database has been confirmed.

• Healthcare professional names and institutions
• Administrator and user contact details
• Reservation dates, times, and status
• Product and company identifiers

Stakeholders should treat any unexpected emails referencing these fields as potential phishing attempts until the full investigation concludes.

Company Response and Ongoing Actions

Toho Holdings issued a formal apology in its October 19 disclosure and emphasized that the incident was isolated. Actions taken include full password resets, security updates, and coordination with law enforcement and regulators. EnTouch continues to work with external specialists to map the intrusion vector and implement additional safeguards.

Further public updates are expected if material new information emerges. As of the latest available reports, no operational disruption to EnTouch services has occurred, and the platform remains functional for users. Organizations that rely on similar remote detailing tools can review their own access logs and vendor security attestations in light of this event.