Hiroshima Gakuin Junior and Senior High School: unauthorized access to Microsoft 365 accounts

On 27 October, Hiroshima Gakuin Junior and Senior High School, run by the Sophia School Corporation, said Microsoft 365 accounts it issues to students and staff had been logged into from abroad. On 14 October it confirmed intrusions into the accounts of 4 current students, 2 graduates and 2 teachers. From those accounts the names and email addresses of everyone with a school account could be viewed, covering graduates from March 2024 to March 2026, students who left, parent accounts and former staff. The investigation also found that in January 2024 a hijacked teacher account sent mail leading to a fake sign-in page to 2,107 school mailboxes. Addresses and grades were not in the system. It disabled 367 graduate accounts and others, notified the Hiroshima police on 16 October and reported to the Personal Information Protection Commission on 19 October.