Osaka Metropolitan University confirms data leak affecting about 170,000 people after cyberattack
The university says the files were taken from cloud storage managed by NEC. They included particularly sensitive records for about 1,400 people. Investigators have not established whether personal data was also taken directly from university systems.
Osaka Metropolitan University said on November 13 that a cyberattack involving a subcontractor led to the leak of personal information concerning approximately 170,000 students and staff members. The files were stored in cloud storage managed by NEC, the contractor responsible for maintaining the university’s computer infrastructure. The university drew an important distinction: that leak has been confirmed, but it has not established that personal data was also stolen from its own internal systems.
The exposed information includes user IDs, names, email addresses and dates of birth. According to the university’s sixth public update on the incident, records for roughly 1,400 people also contained more sensitive material, including bank account numbers, health information, passport images and passport numbers. Those 1,400 people are included in the estimated total of 170,000; they are not an additional group.
Investigators traced a sequence of unauthorized access. A device used by a company subcontracted by NEC was compromised first. They found evidence that information was taken from that device and from NEC-managed cloud storage. Soon afterward, valid accounts and passwords used for the university contract, including administrator credentials, were used to enter university systems without authorization. An outside investigative firm found several indicators consistent with the same attacker being behind both intrusions, the university said. It has not publicly identified the perpetrators.
The attack caused a major outage in the university’s information systems on October 2. Some systems were encrypted, according to its statement. The university says investigators have found no clear evidence so far that personal information was taken from those systems, but they cannot rule it out. The two findings should not be conflated: the leak from NEC-managed storage is confirmed; a separate leak from university systems remains unconfirmed.
The university also criticized NEC for retaining files from a 2021 systems migration for years after that work had finished, in cloud storage used by many people involved in the contract. Much of the particularly sensitive information came from those old migration files, the university said. Data kept after a project ended remained vulnerable when the contractor’s environment was breached.
NEC is still working to identify who was affected and which information belongs to each person. The university said it will contact affected individuals separately and has opened an inquiry channel for graduates and families. It warned people to watch for suspicious calls and impersonation emails. Anyone who may be affected should rely on the university’s direct notifications and official updates: the overall figure does not yet show what was exposed about any particular person.
