Kyoto Institute of Technology: a design flaw in its academic system left personal data on 2,539 students and others viewable from outside since the system was introduced in 2011

1. 2025-08-07

   An outside party pointed out that one notice file meant for campus use was viewable from outside. The university cut off external access and deleted the file, and found it had been set to public by mistake. [1]

2. 2025-09-11

   An emergency check found a design flaw in the folder, and the university announced the incident. All files have been moved off the server and are no longer reachable from outside. [1] [2]

In the system introduced in fiscal 2011, 5,813 notice board files, 2,599 email attachments and 1,649 other files sat in one folder viewable and downloadable from outside. Of about 10,000 files checked, 544 held names, student numbers, contact details and similar data, covering 2,539 people. One file holds a health checkup certificate (1 person); bank account details cover 2 people, household finances and scholarship applications 26, class-related contact documents 1,002, and contacts at other institutions' career offices 749. [1]

The state is presumed to have lasted since the introduction. The university is examining the access logs it still has, from August 8, 2024 to August 7, 2025, and has confirmed no misuse or risk of misuse. [1]