Medley Inc. halted its Atlink medical back-office platform late Wednesday after confirming that a third party had broken into systems used by hundreds of clinics and hospitals across Japan, potentially exposing patient data registered in the cloud service.
The Tokyo-listed health-technology company said it received a warning from an outside security firm on Oct. 11, began investigating and verified unauthorized access. Medley kept limited services running while it assessed impact on medical institutions, then suspended Atlink, its patient smartphone app and related tools overnight on Oct. 14 to prevent further damage.
Scale of the exposure
In a disclosure filed to the Tokyo Stock Exchange, Medley said personal information tied to patients and other users may have leaked externally. The company cautioned that up to all 787 medical institutions on Atlink could be affected while forensic work continues with outside specialists.
Medley has reported the incident to Japan’s Personal Information Protection Commission and consulted police. It described the expected hit to consolidated earnings for the year ending December 2026 as minor, but the operational disruption is already visible: clinics that rely on Atlink for appointments, billing and electronic records must fall back to manual workflows until service resumes.
What clinics are facing
Atlink is widely used by small and midsize practices that lack in-house IT teams. Medley’s public notice apologized to patients and providers, opened dedicated inquiry channels for hospitals and the press, and said restart timing would depend on the investigation’s findings.
The breach lands during a week when Japanese markets were already under pressure from a global selloff in chip and AI-linked shares. For Medley, the immediate test is whether it can restore trust with regulators and a customer base that cannot easily switch patient-record systems mid-quarter.
Regulatory and security response
Japan’s privacy commission typically expects prompt victim notification once the scope of a medical data leak is known. Medley said it is implementing additional safeguards and will disclose more if the investigation widens.
Police involvement signals that prosecutors may treat the intrusion as a criminal unauthorized-access case rather than a purely civil matter. Patients were urged to watch for unusual contact from third parties, though Medley has not yet listed which data fields—names, insurance numbers, clinical notes—were definitely taken.
Hospital groups said they were polling member clinics to see who still had offline billing queues on Thursday afternoon. Medley shares fell with the wider technology selloff, but analysts said the reputational cost with regulators could outlast a single-day stock move if restart slips into next week.