Tokyo University of Agriculture and Technology: two staff mail accounts broken into, personal data leaked and phishing sent

1. 2019-04-06

   Someone logged into the first account and set it to forward incoming mail to a suspicious outside address. [1]

2. 2019-10-08

   A staff member reported bounces of mail they had not sent; the check found the forwarding, which had run until then. [1]

3. 2019-10-24

   Another staff account was broken into and used to send phishing emails to 288 recipients. [1]

4. 2020-02-05

   Public disclosure. [1]

• Names, email addresses, phone numbers, student numbers and more of 409 students and outside people. [1]
• Names, email addresses, phone numbers and more of staff, {n:4044} entries in total. [1]

The university changed both passwords and removed the forwarding. It could not tell how the passwords were stolen and said it would introduce multi-factor authentication and other measures. [1]