> JapanHacked_
[Investigating][Severity: Critical][Web app exploit]

Consortium of Universities in Osaka: web system intrusion

A vulnerability in the consortium's credit transfer and internship application system was exploited; students' addresses, student numbers, login passwords and more may have leaked.

Disclosed

2026-10-28

Organizations involved

1

Leaked or at risk

1.9K

1,876

Downtime

Unknown

What happened

  1. The application and management system built and maintained by Yubunsha was accessed illegally through a vulnerability. [1]

  2. The consortium noticed the problem and closed the system. [1]

  3. It sent a preliminary report to the Personal Information Protection Commission. [1]

  4. It published the incident. [1]

Impact

  • Students: applicants for credit transfer (635 and 604 entries) and internships (176 and 142) in fiscal 2025 and 2026, 1,557 entries in total. Names, universities, student numbers, birth dates, gender, addresses, phone numbers, email addresses, emergency contacts, application details, and login IDs with system-issued passwords. [1]
  • Host companies: 111, 112 and 96 entries, 319 in total. [1]
  • Member universities: admin accounts of 43 universities. [1]

The internship diary system of another contractor on the same shared server also saw suspicious access and attempts to connect to its database, with no sign that they succeeded. [1]

Response

The system stays closed while the investigation continues, and the consortium is contacting the students, companies and universities concerned. [1]

Timeline

  1. Started 2026-10-20
  2. Detected 2026-10-21
  3. Disclosed 2026-10-28
  4. 8 days

Attack or cause

Method
[Web app exploit]
Impact
[Data leak][Service outage]
Entry point
Web app

Data exposed or at risk

[Name][Education][Date of birth][Gender][Postal address][Phone number][E-mail address][Passwords]

Organizations involved

Sources

  1. [1][Official]本法人 Web システムへの不正アクセスによる個人情報漏えいのおそれに関するお詫びとお知らせConsortium of Universities in Osaka · 2026-10-28