TL;DR
- 01What happened
On June 8, 2026, the National Hospital Organization’s Hokkaido Medical Center and Hokkaido Cancer Center (Sapporo) disclosed that some hard drives from terminals they had sent out for disposal when replacing their electronic medical record systems had circulated outside without being shredded. They learned of it in June 2025 from two people who had won the drives at online auction (press). The recovered drives held information on about 179,000 patients across the two hospitals.
- 02Why it was hard to tell
The contractor, Reprowork, says part of its destruction process may have been inadequate and the drives reached the auction via a recycling dealer. It also explained that drives before and after shredding were kept in identical containers (press). The hospitals did not confirm, drive by drive, that the drives were destroyed.
- 03The missing layer
The buyers’ report led to recovery, and the NHO filed a criminal complaint against the contractor. But this was noticed only after the drives had been resold. What failed was the layer that lets the client confirm, drive by drive, that what it sent was really destroyed.
What happened
- Who
- The National Hospital Organization (NHO)‘s Hokkaido Medical Center and Hokkaido Cancer Center in Sapporo.
- Outsourcing
- When replacing their electronic medical record systems, they outsourced disposal of retired terminals to an outside waste contractor. According to the press, the Medical Center handed about 750 drives in March 2024, and the Cancer Center about 570 in November 2024, to the same contractor in Ishikari (Reprowork).
- Circulation
- Some drives circulated outside without being properly shredded (per the hospitals). The contractor says part of its destruction process may have been inadequate and the drives went to online auction via a recycling dealer, and denies any intent (per the company).
- Discovery
- In June 2025, two people who won drives at online auction reported finding what seemed to be Hokkaido Medical Center data (press).
- Scale
- The NHO recovered 90 drives listed online, 33 of which held medical-record data (press). The recovered drives held about 170,000 Medical Center patients and about 8,800 Cancer Center patients (per the hospitals). The hospitals also gave a theoretical maximum based on total patient IDs (about 510,000 in the press), saying this does not mean all of them leaked.
- Data
- Names, patient numbers, dates of birth, addresses, phone numbers, visit dates, departments, admission details, diagnoses, test results, allergies and parts of nursing records. No My Number, bank or card numbers.
- Misuse
- No misuse or secondary harm has been reported (per the hospitals).
Glossary
Electronic medical records — Systems that store patients' clinical records electronically, including highly sensitive data such as diagnoses and test results.
Physical destruction (shredding) — Crushing or drilling a hard drive so its data can't be read. A different method from wiping with software.
The point to stop it was ②. Had the client confirmed with photos or records that each drive was destroyed, undestroyed drives would have been found before they got out.
2024.
Contractor's explanation (press).
Resold without checking (press).
2025-06.
Timeline — disclosure and response
- Hokkaido Medical Center outsources disposal of about 750 drives (press).
- Hokkaido Cancer Center outsources about 570 drives to the same contractor (press).
- Two online-auction buyers report finding what seems to be hospital data (press).
- The hospitals disclose. The NHO files a criminal complaint with Hokkaido police against the contractor under the Waste Management Act (press). The same day, the Ministry of Health tells prefectures to tighten measures against leaks when disposing of IT equipment.
- The contractor publishes a statement acknowledging its processing may have been inadequate.
- Data on 4,721 patients of another Sapporo hospital (Shin-Sapporo Houwakai Hospital) is reported found among the recovered drives.
The hospitals’ notices (primary) do not cover the contract dates and drive counts, the contractor’s name, how it was discovered, the number of drives recovered or the criminal complaint; these rest on press reports and the contractor’s statement. The press figure of about 186,900 people (patients and staff) does not match the hospitals’ patient counts, and the gap is unexplained. Why it took about a year from discovery to disclosure has not been explained either. As of October 2026, no progress in the police investigation has been disclosed.
After disclosure
- Hospitals: Will make reliable physical destruction on site the rule, require checks by more than one person, and tighten contractor selection and oversight.
- Ministry of Health: Told medical institutions to require witnessing of disposal and submission of photos of destroyed media or wipe logs, and to check before contracting whether work will be subcontracted.
Why it wasn’t stopped
This case was not only one contractor’s carelessness. Whether the drives were destroyed was left to the contractor’s work, and the hospitals had no means of confirming, drive by drive, that they were.
The client left it to the contractor's work whether the drives it sent were really destroyed, never checking, and undestroyed drives reached the internet through resale.
Proof works before disposal is treated as done; detection works after a drive is found outside. In between, drives sent out are treated as "should be destroyed".
resold and listed online
Detection worked, but it was neither the hospitals nor the contractor that noticed; it was members of the public who bought the drives. “Disposal was outsourced” and “each drive was destroyed” are separate facts, yet the first stood in for the second. That distance is the detection–proof gap, and it is a structural one.
The same structure appears in Awa Bank (customer data that should have been deleted left in a test environment past its purpose).
How to counter this
Confirm that media sent out was destroyed with records for each drive, not the contractor’s word. The Ministry of Health, too, says to require witnessing of disposal and photos of destroyed media or wipe logs. Even when switching to on-site destruction, recording who destroyed which drive, and when, still matters.
Industries and operations to watch
- IndustryHealthcare
- Medical institutions that dispose of large amounts of equipment holding patient data, for example when upgrading record systems. Diagnoses and test results do great harm if leaked.
- OperationEquipment disposal
- Outsourcing disposal of PCs and servers. The contractor may subcontract further or resell.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Shredding terms in the contract | Partial | The contractor had agreed to shred, yet some drives were not destroyed. |
| Witnessing disposal | Partial | Witnessed drives can be confirmed, but witnessing hundreds is hard. |
| On-site physical destruction (new measure) | Partial | It avoids relying on a contractor, but without records of who destroyed which drive, the same difficulty remains. |
| Reports from buyers and others | Partial | It led to recovery, but the drives had already been resold. |
- Get evidence of destruction for each drive. Receive each drive’s serial number tied to photos after destruction or wipe logs, and match them against the number of drives sent.
- Don’t treat unconfirmed drives as done. Drives without complete evidence are not counted as disposed of; ask the contractor. Check before contracting whether work will be subcontracted.
- Record what was confirmed. For each drive, keep who destroyed it, when and how, in a form that can later be shown to a third party: in other words, as proof.
Three things to confirm in your organisation about equipment disposal
- Can you list, by serial number, each device you sent out for disposal?
- For each one, have you received photos of its destruction or wipe logs?
- Do you check before contracting that the contractor won’t subcontract or resell?
Note: if the photos or logs themselves are faked, this check passes too. The more devices there are, the more work it takes to confirm each one.
Sources
- Primary, hospital noticeHokkaido Medical Center Apology and report on the handling of personal information
- Primary, hospital noticeHokkaido Cancer Center Apology and report on the handling of personal information
- Primary, contractor statementReprowork Statement on the drives it handled for the two hospitals
- Primary, noticeMinistry of Health, Labour and Welfare On thorough measures to prevent personal data leaks when disposing of IT equipment
5 more (reporting, analysis)
- ReportingUHB Hard drives sent for shredding found at online auction
- ReportingNHK Possible leak of up to about 510,000 people’s data at Hokkaido Medical Center and another hospital
- Reporting, via Kyoto ShimbunKyodo News Data on 186,000 patients and others leaked
- Reporting, interview with the contractorHokkaido Shimbun Drives sold without confirming shredding; contractor cites “a careless mistake”
- ReportingHokkaido Shimbun 4,721 patients’ data also on leaked drives from Shin-Sapporo Houwakai Hospital
References: “The last layer left for cyber defense in the age of AI”