Waseda University: 3,342 user records exposed, including encrypted passwords used with MyWaseda

A review prompted by PHP vulnerability remediation found traces of unauthorized access on 31 August and confirmed data acquisition from a personal-information system. PHP remediation prompted discovery; the notice does not establish a particular PHP vulnerability as the entry route. The affected system manages user information used to log into MyWaseda. [1]

Individually acquired records total 81: names/qualification labels (38), names/qualification labels/email (23) and names/encrypted passwords (20). A further 3,261 records contain staff numbers, names, email, departments, qualification labels and encrypted passwords together, giving 3,342 records in total. Multiple emails can belong to one person, so this is not a person count. The encryption method is not specified. [1]

Related systems were stopped, external access restricted and administrator passwords changed. Alumni Waseda ID services are suspended, and students/staff receive individual instructions. Specialists are investigating entry and additional exposure. Impact on entrance applicants and Open College participants is not currently confirmed. [1]