Kyoto University of Foreign Studies: intrusion into its old website server; personal data of 5,376 people may be exposed

From 21 October an outsider could operate the old server that hosted the website. Traces of the intrusion were found on the 30th and the server was disconnected that day. Logs show the server's files were read in bulk during the intrusion. No removal or misuse of data has been confirmed. [1]

The university believes a malicious program was placed through a website update function on the old server that worked without login, and that an unpatched flaw in an end-of-support operating system was used. Old programs and data left on the server widened the impact. The website now runs on another server. [1]

The 5,376 people are mainly those who used website forms from 2000 to 2017: alumni and past students, staff and student groups of the university and junior college, the vocational school, Kyoto Gaidai Nishi High School and the alumni association. Items are name, address, phone, email, student ID, employer, school and year, plus birth date for some. Some vocational school absence forms included health information. No card data is included. [1]

The university reported to the education ministry and the Personal Information Protection Commission on 4 November, consulted Kyoto police and reported to JPCERT/CC. Passwords still in use were changed and an outside firm will investigate. People with known email addresses are contacted individually from the 11th. [1]