Rikkyo University: Google accounts of six students and alumni were accessed without authorization and 17,668 spam mails were sent

1. 2026-04-27

   Unauthorized access to Google accounts of students and alumni began. The later investigation showed that four accounts, two students and two alumni who graduated in March, were hit from this date to July 16. [1]

2. 2026-07-16

   It detected unauthorized access from overseas and the sending of spam. [1]

3. 2026-08-12

   Through August 24 it detected unauthorized access from overseas and spam sending on the accounts of two more students. [1]

4. 2026-08-24

   It made multi-factor authentication mandatory for logins to student accounts from outside the university; staff accounts have required it since March. [1]

5. 2026-09-08

   The university announced the unauthorized access and the spam. The spam totaled 17,668 mails. [1] [2]

The names and email addresses of one faculty member appeared in some spam bodies. The subjects also contained content that appears to come from mail in the accounts' inboxes, so viewing of mail bodies and personal data cannot be fully ruled out. One Microsoft 365 account showed suspicious login history and its profile data might have been viewed, so the session was cut. There was no sign of intrusion into Google Workspace apps other than Gmail, the VPN or the campus network. No secondary damage such as misuse of personal data has been found. [1]