Osaka University says data of about 78,000 people leaked via contractor NEC
In short
Osaka University announced that personal information of about 78,000 people, including names and email addresses, has leaked. ITmedia reported the figure as 77,851 students, graduates and staff, and said NEC, which runs the system under contract, shared the files with a partner company the university had not been told about.
Read the full story 2 min read
Osaka University announced that personal information of about 78,000 people, including names and email addresses, has leaked. Outlets reported that the affected people include current students and graduates. ITmedia reported that the university announced on October 21 that the leak came from NEC, which it contracts to operate the university-wide educational computer system, and put the total at 77,851 people. [ 1 , 2 , 3 , 4 ]
According to ITmedia, the total consists of 15,035 current students, 59,014 graduates and 3,802 faculty and staff, with duplicates excluded. The items differ by person, but the main ones are name, Osaka University personal ID, the email address issued by the university, student or staff number, and affiliation. [ 4 ]
The university said that on October 9 NEC reported that a file containing personal information had been downloaded by a third party. ITmedia added that the download took place on September 26. A later investigation found that NEC had involved a partner company in operating the system without the university's permission. The leaked information had been stored on cloud storage that NEC and the partner company used to share information. [ 1 , 2 , 3 , 4 ]
ITmedia reported that NEC had put the files on the cloud storage in order to share information with a partner company the university had not been told about. NEC had also kept files that should have been deleted once the work ended. NEC's investigation found no trace of unauthorized access to the system it operates for the university, and no misuse of the leaked information or secondary damage had been confirmed so far. [ 4 ]
The university described the involvement of the unreported partner company, and NEC's sharing and holding of files containing personal information outside its contract with the university, as a serious problem. It is asking NEC to work toward resolving the incident, determine the cause and take thorough measures to prevent a recurrence. The university said it will notify the affected people individually. It also urged people to be careful about spoofing emails that exploit the leaked information. [ 1 , 2 , 3 , 4 ]
ITmedia said the university links to an NEC announcement of October 20 about unauthorized access to a contractor. According to that material, an NEC contractor was hit by a cyberattack in late September and files in cloud storage leaked. Several NEC customers were affected, but the material does not name them. [ 4 ]
Why it matters
The university called the unreported partner's involvement and NEC's handling of the files a serious problem and is asking NEC for a cause investigation and measures to prevent a repeat. Affected people are being told to watch for spoofing emails, and the documents report no confirmed misuse so far.
Key facts
- Osaka University announced that personal information of about 78,000 people was leaked, including names, university personal IDs and email addresses. [ 1 , 2 , 3 , 4 ]
- ITmedia gave the total as 77,851 people: 15,035 current students, 59,014 graduates and 3,802 faculty and staff, excluding duplicates. [ 4 ]
- On October 9 the university was told by NEC, which it contracts to operate its systems, that a file containing personal information had been downloaded by a third party. [ 1 , 2 , 3 , 4 ]
- An investigation found that NEC had involved a partner company in operating the system without the university's permission. [ 1 , 2 , 4 ]
- The leaked data had been stored on cloud storage that NEC and the partner company used to share information. [ 1 , 2 , 4 ]
- The university urged people to be careful about spoofing emails that exploit the leaked information. [ 1 , 2 , 3 ]
Confirmed by several sources
- Osaka University announced a leak of personal information of about 78,000 people, covering current students and graduates. [ 1 , 2 , 3 , 4 ]
- The university said NEC reported on October 9 that a file with personal information had been downloaded by a third party. [ 1 , 2 , 3 , 4 ]
- NEC involved a partner company in the system's operation without the university's permission, and the leaked data was held on cloud storage shared by NEC and the partner. [ 1 , 2 , 4 ]
Still unclear
- Whether the leaked information has been misused. ITmedia reported that NEC found no sign of unauthorized access to the system and that no misuse or secondary damage had been confirmed so far; no other document addresses this.
- Whether this case is part of the cyberattack on an NEC contractor that NEC announced on October 20. ITmedia said the university links to that announcement and that it describes a late-September attack on an NEC contractor affecting several customers, but it names no customers.
- The exact composition of the roughly 78,000 people. Two outlets mention students and graduates only, while ITmedia also includes faculty and staff.
- Osaka University warned people to be careful about spoofing emails. Reported by a single source so far
What local media are saying
Timeline, local time
- Livedoor News published a report that Osaka University had announced the leak of about 78,000 people's data (October 21). [ 1 ]
- TBS NEWS DIG published a breaking report on the announcement (October 21). [ 2 ]
- TBS NEWS DIG published a follow-up report with the October 9 report from NEC and the warning about spoofing emails (October 22). [ 3 ]
- ITmedia published details of the 77,851 affected people and NEC's data sharing with a partner company (October 22). [ 4 ]