At-link: unauthorized access to obstetrics system affecting up to 787 medical institutions
atlink-medley-2026 · Disclosed 2026-10-15
Medley's obstetrics clinic support system 'At-link' was subject to unauthorized access by a third party. Information was obtained from the database through maliciously deployed programs from late September to mid-October. Up to 787 medical institutions are affected, with potential leakage of patient names, birth months/days, email addresses, login IDs/passwords, visit dates, and payment information.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
Confirmed that a third party accessed the database and obtained information through maliciously deployed programs from late September to mid-October 2026.
[s1]2026年9月下旬から10月中旬にかけて、不正に設置したプログラム - Reported fact
787 medical institutions use the affected service. Information at risk includes names, furigana, birth months/days, email addresses, login IDs/passwords, medical institution names, visit dates, and app payment information.
Timeline
Received information from external specialists about potential unauthorized access and began investigation. [s2]
Service temporarily suspended from late night to prevent further damage and enable additional investigation. [s1]
Announced unauthorized access. [s1]
Resumed partial functionality as new service '@link Cloud β' built in separate environment. [s3]
Reported response
- Reported fact
Temporarily suspended service from late night on October 14 to investigate causes, determine impact scope, and prevent further damage. Instead of restarting the original system, migrated data to a newly constructed service in a separate environment and resumed provision gradually.
- Reported fact
Investigation proceeds in cooperation with external specialists. Affected individuals will be notified individually through coordination between the operating company and medical institutions.
[s1]外部の専門機関と連携して進めてまいりました調査
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Insufficient evidence
The method of malicious program deployment and privilege controls at the time are unknown. Related rules inspect database access controls, anomaly detection, and medical information protection.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed primary sources do not establish attacker use of AI.
787 is the count of potentially affected medical institutions, not confirmed leak count. Entry method, CVEs used, and exact number of affected patients remain unresolved.
Sources
[s1] メドレー · Primary source
アットリンクへの不正アクセスおよびサービスの一時停止に関する最新情報 ↗Published 2026-10-15 · Reviewed 2026-11-02
[s2] ITmedia NEWS · Secondary
メドレーの産婦人科向けシステムに不正アクセス、患者の個人情報漏えいか 最大787の医療機関が対象 ↗Published 2026-10-15 · Reviewed 2026-11-02
[s3] ITmedia NEWS · Secondary
メドレー、不正アクセスで停止中のサービスを作り直して再開へ 従来システムは再稼働させず ↗Published 2026-10-20 · Reviewed 2026-11-02