On October 27, 2026, MICIN, Inc. announced that third parties had logged in without authorization to its online consultation service, "Curon Online Consultation." Through clinic accounts, information on 73 patients at three medical institutions was viewed.
According to the company, the method appears to have been credential stuffing ("list-based attack"), which uses ID and password combinations leaked from other services. Unlike a brute-force attack that tries passwords one after another, the attacker logs in with the correct ID and password, so a complex password does not help if it is reused.
This is not only a problem for clinics that offer online consultations. Every service reachable from outside the clinic — EMRs, web booking, web questionnaires, email — is a target for the same attack. This article confirms the facts from the official announcement and sets out why two-factor authentication is needed and what clinics should do now.
This article is general information based on information published as of October 31, 2026. Details of the case are as of MICIN's announcement and may change as the investigation continues.
Overview of the case
MICIN's announcement of October 27, 2026, is summarized below.
| Item | Details |
|---|---|
| Service | Online consultation service "Curon Online Consultation" |
| Date | October 23, 2026 (detected the same day) |
| Method | Believed to be credential stuffing using ID and password combinations obtained externally |
| Accounts logged into | Clinic accounts: 6 accounts at 5 institutions / Patient accounts: 14 accounts |
| Patient information viewed | 73 patients at 3 institutions (via clinic accounts) |
| Information that may have been viewed | Patients' name, email address, phone number, date of birth, address, sex, chart number, patient card number, visit status, physician notes and more; for some patients, also prescription images, consultation records and service usage history |
| Not included | Identity documents and password information. The company does not hold credit card information |
| System intrusion | As of the announcement, no sign of intrusion into the company's servers or databases had been found |
The company says it blocked traffic from the source of the unauthorized access, reset the passwords of affected accounts and of accounts without two-factor authentication, logged out all clinic accounts, strengthened monitoring, and reported to the Personal Information Protection Commission. It asked clinics to reset their passwords to ones not used elsewhere and to set up two-factor authentication, and asked patients to stop reusing passwords and to use their device's passkey feature (fingerprint or face recognition).
According to news reports, Minister of Health, Labour and Welfare Kenichiro Ueno said at a press conference after the Cabinet meeting on October 30 that the ministry had issued a notice asking medical institutions and medical information system vendors to, among other things, make thorough use of multi-factor authentication and urgently review access logs.
Brute-force attacks versus credential stuffing
There are several kinds of attacks on passwords. Because the defenses differ, it helps to tell them apart.
| Attack | How it works | Effective defense | Does a complex password stop it? |
|---|---|---|---|
| Brute force | Tries every possible character combination against one ID | Login attempt limits, long and complex passwords | It helps |
| Dictionary attack | Tries common words and passwords such as "password123" | Banning guessable passwords | It helps |
| Password spraying | Tries one common password slowly across many IDs | Banning guessable passwords, monitoring suspicious logins | It helps |
| Credential stuffing | Tries ID and password pairs leaked from other services as they are | Stop reusing passwords; two-factor authentication | Not if the password is reused |
In credential stuffing, the attacker arrives already holding the "right answer." Because it succeeds within a few attempts, it rarely trips attempt limits, and however complex a password is, it will be broken if it is the same as on another service.
If staff use the same password at work as on personal services, a leak at a service unrelated to the clinic becomes a direct entry point into the clinic.
Why two-factor authentication stops it
Authentication factors fall into three types:
- Knowledge: something only the user knows (password, PIN)
- Possession: something only the user has (smartphone, IC card, hardware token)
- Inherence: a physical trait of the user (fingerprint, face)
Two-factor authentication verifies the user by combining two different types. Even if a password leaks, the attacker does not have the staff member's smartphone or IC card, and cannot log in. Against attacks that assume the password is already known, such as credential stuffing, it is the most effective defense.
Strength varies by method, however.
| Method | Characteristics |
|---|---|
| Codes sent by SMS | Easy to introduce. Weak against phone number takeover and fake sites that trick users into entering the code |
| One-time codes from an authenticator app | Safer than SMS. Still watch for fake sites that relay codes in real time |
| Passkeys (fingerprint, face recognition, etc.) | Work only on the genuine site, so they are hard to misuse even if a user is lured to a fake site |
| IC cards and hardware tokens | Practical in clinics with many shared terminals. A procedure for lost cards is needed |
Where a service offers a choice, prefer passkeys or an authenticator app. Even where that is not possible, simply turning on SMS two-factor authentication greatly improves resistance to credential stuffing.
Regulatory position
Two-factor (multi-factor) authentication is written into guidance for the medical sector.
- Guidelines for the Appropriate Implementation of Online Medical Care (revised April 2026): Among measures for medical institutions, it states that "when using a system for online medical care, it is desirable to use multi-factor authentication." It also states that vendors should preferably manage access rights for staff and contractors who operate and maintain the system with multi-factor authentication or similar means.
- Guidelines for the Safe Management of Medical Information Systems, Edition 6.0 (System Operations): Where users are authenticated with passwords, it is a requirement that "when newly introducing or updating medical information systems expected to be in operation as of FY2027, a system adopting two-factor authentication, or an equivalent measure, be introduced."
The online medical care guidelines use the word "desirable," but following this case the MHLW is reported to have called for thorough use of multi-factor authentication, and leaving it off when it can be turned on is becoming hard to justify.
What clinics should do now
1. List the services reachable from outside the clinic
List every service that can be logged into from outside, not only online consultations.
- Online consultation, web booking, web questionnaires
- Cloud EMRs and billing systems
- Email, groupware, file sharing
- Online eligibility verification and portals for medical institutions, and vendors' remote maintenance connections
2. Turn on two-factor authentication
For each listed service, check whether two-factor authentication is set up, and turn it on right away wherever possible. In this case, passwords for accounts without two-factor authentication were reset across the board. Having the feature available but not using it is the most dangerous state.
3. Stop reusing passwords
Always keep work passwords separate from personal services. If staff cannot remember them all, allowing a password manager by rule is safer than notes or reuse (Designing a Password Policy).
4. Stop shared IDs and disable former staff accounts
When several staff share one ID, you can neither set up two-factor authentication nor trace who did what. Issue an ID to each staff member and disable accounts on the day someone leaves (Access Rights Design and Privileged ID Management).
5. Review login history
The MHLW notice is also reported to call for reviewing access logs. If the service's admin screen shows login history, check for logins at unfamiliar times or from unfamiliar locations.
6. Check with your vendors
Confirm the following with the vendors you use (Questions to Ask Vendors):
- Is there a setting to make two-factor authentication mandatory?
- Do they limit login attempts and detect suspicious logins?
- Can the clinic view login history?
- How will they contact the clinic if unauthorized logins are suspected?
7. Inform patients
In online consultations, patient accounts are targeted too. In patient guidance, ask them not to reuse passwords and to use features such as passkeys where available. Also tell them that neither the clinic nor the vendor will ever ask for a password or verification code, which helps prevent scams that piggyback on such incidents.
If you suspect unauthorized logins
- Change the password for the account and set up two-factor authentication
- Contact the vendor and confirm the login history and the scope of information viewed
- If clinical information may have been viewed, consider reporting to the Personal Information Protection Commission and notifying the individuals (preliminary report roughly within 3 to 5 days; final report within 30 days in principle, or 60 days where the incident may have been carried out for an improper purpose such as unauthorized access)
We cover reporting in Reporting Obligations After a Personal Data Breach, and the response flow in Incident Response Plans for Medical Institutions.
Frequently asked questions
Q. If we make passwords long and complex, do we still need two-factor authentication? A. Complexity helps against brute force, but not against credential stuffing. If the same password is used on another service, the attacker logs straight in regardless of length or complexity.
Q. Was this case caused by a flaw in the vendor's system? A. As of MICIN's announcement, no sign of intrusion into its servers or databases had been found, and the logins are believed to have used externally obtained IDs and passwords. The key point is that even a secure system exposes information once account authentication is broken.
Q. Won't two-factor authentication make every login tedious? A. Many services let you register a trusted device and skip the check for a period. For shared terminals inside the clinic, see the practical approach in Deploying Multi-Factor Authentication.
Summary
- The MICIN case is believed to be credential stuffing using IDs and passwords leaked from other services, and information on 73 patients was viewed
- In credential stuffing the attacker logs in with the correct password, so a complex password does not help if it is reused
- Two-factor authentication blocks logins even when the password is known, making it the most effective defense
- The online medical care guidelines call multi-factor authentication "desirable," and the safe management guidelines require two-factor authentication when systems are newly introduced or updated
- Start by listing services reachable from outside the clinic and turning on two-factor authentication
For the full set of leak routes and the order in which to tackle them, see Security Measures Clinics Must Take in an Era of Data Breaches.
Pottech provides EMR and medical DX services for medical institutions and supports building healthcare information security practices. If you have concerns about account management or authentication settings at your clinic, please feel free to contact us.
References
- MICIN, Inc., "Report on Unauthorized Logins to the Online Consultation Service 'Curon Online Consultation'" (October 27, 2026) https://micin.jp/news/14859/
- Jiji Press, "Notice to Medical Institutions to Strengthen Measures After Online Consultation Unauthorized Access: Health Minister Ueno" (October 30, 2026, via Yahoo! News) https://news.yahoo.co.jp/articles/f9a8f6021cfb952d77fd2d83be2dcd89f781ee31
- MHLW, "Guidelines for the Appropriate Implementation of Online Medical Care" (revised April 2026) https://www.mhlw.go.jp/content/001685701.pdf
- MHLW, "Guidelines for the Safe Management of Medical Information Systems, Edition 6.0: System Operations" https://www.mhlw.go.jp/content/10808000/001582980.pdf
- Personal Information Protection Commission, "Responding to Breaches and Useful Materials" https://www.ppc.go.jp/personalinfo/legal/leakAction/