Osaka Metropolitan University: attack on an NEC contractor disrupts systems and exposes information

An NEC development and maintenance contractor was attacked in late September. Stolen legitimate credentials enabled access to customer systems and NEC's shared cloud storage. About 500 Osaka Metropolitan University servers stopped on October 2; it disclosed ransomware on October 5, cancelled classes at five campuses October 2–8 and resumed in-person teaching October 9. Its October 21 fifth report linked entry to credentials stolen from NEC's subcontractor. Exfiltration of about 130,000 academic records in its own infrastructure remains unconfirmed; a separate leak from NEC cloud storage is confirmed, with the count still under investigation. Osaka University, a separate institution, reported that files concerning 77,851 graduates, students and staff were downloaded from that cloud on September 26, including names, IDs, emails and affiliations. The 77,851 people and roughly 130,000 records describe different scopes; no combined affected-person total was published.