Summary
- Environment: Legacy website server and historical form records
- Operational impact: Old server isolated; website moved to another server
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed November 11, 2026; updated as evidence emerges.
What happened
Kyoto University of Foreign Studies said an intruder controlled its old website server between October 21 and its October 30 disconnection. Logs showed bulk file reads, but external removal was unconfirmed. [1]
Impact
The potentially affected records concerned 5,376 deduplicated people, mainly from 2000–2017. Fields varied: contact, student and employment details, some birth dates, and some health-related absence explanations. Credit-card information was excluded. [1]
Timeline
Threat Group & Attack Vector
The university believes an unauthenticated update function allowed malicious-program placement. It also identified exploited, unpatched weaknesses in an unsupported operating system. No specific vulnerability was named. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1190 — Exploit Public-Facing Application: weaknesses in the public website server enabled intrusion. [1]
Response
The website moved to another server, still-used passwords were being changed, and authorities were informed. The university planned external investigation and removal of obsolete programs and data. [1]