medley-atlink-2026 · Disclosed 2026-10-14
Medley at-link: unauthorized access to a medical booking platform
An external report on October 11 led to confirmation of unauthorized access; service stopped late October 14. Potential exposure covers up to 787 medical institutions, not 787 patients.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
An external specialist reported possible access on October 11; investigation confirmed unauthorized access.
[s1]§1 - Reported fact
All 787 customer medical institutions form the maximum possible scope. Whether information leaked, its fields and affected institutions remain under investigation.
[s1]§2 - Reported fact
Shijo Karasuma Ladies Clinic uses the service for reservations only and said its separate electronic medical-record system remained operational.
[s2]本文
Timeline
Reported response
- Reported fact
Interim support preceded service suspension; external specialists continue investigating scope.
[s1]§1–3
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Insufficient evidence
The entry mechanism is undisclosed; avoidability cannot be assessed. Inspect exposure, privileges, logs and retained data using the linked rules.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed disclosures do not establish attacker use of AI.
The intrusion start, mechanism and patient count are undisclosed. The notice does not confirm leakage at all 787 institutions.
Sources
[s1] メドレー · Primary source
当社サービス「アットリンク」への不正アクセス及びサービスの一時停止に関するお知らせ ↗Published 2026-10-15 · Reviewed 2026-10-19
[s2] 四条烏丸レディースクリニック · Primary source
【重要】当院予約システム「アットリンク」のサービス一時停止について ↗Published 2026-10-14 · Reviewed 2026-10-19