--- title: "Kyoto University of Foreign Studies legacy-server intrusion" description: "A legacy website server intrusion left records relating to 5,376 people potentially exposed at Kyoto University of Foreign Studies." incident_type: "Cybersecurity incident" status: "active" last_modified: "2026-11-11" canonical_url: "https://www.ally.security/incidents/kyoto-foreign-studies-legacy-server-intrusion-2026" markdown_url: "https://www.ally.security/incidents/kyoto-foreign-studies-legacy-server-intrusion-2026.md" stix_url: "https://www.ally.security/incidents/kyoto-foreign-studies-legacy-server-intrusion-2026/stix.json" --- # Kyoto University of Foreign Studies legacy-server intrusion A legacy website server intrusion left records relating to 5,376 people potentially exposed at Kyoto University of Foreign Studies. Last modified Nov 11, 2026 · 1 source ## Summary - **Environment:** Legacy website server and historical form records - **Operational impact:** Old server isolated; website moved to another server - **Financial impact:** No confirmed incident cost quantified ## What happened [Kyoto University of Foreign Studies](https://www.kufs.ac.jp/) said an intruder controlled its old website server between October 21 and its October 30 disconnection. Logs showed bulk file reads, but external removal was unconfirmed. [1](#source-1) ## Impact The potentially affected records concerned **5,376 deduplicated people**, mainly from 2000–2017. Fields varied: contact, student and employment details, some birth dates, and some health-related absence explanations. Credit-card information was excluded. [1](#source-1) ## Timeline ### October 21, 2026 — Intrusion begins The start was established retrospectively. [1](#source-1) ### October 30, 2026 — Server isolated Intrusion traces prompted disconnection. [1](#source-1) ### November 10, 2026 — Public notice issued The [notice](https://www.kufs.ac.jp/cms_image/file/file_1794271641.pdf) described potential exposure across affiliated schools and alumni records. [1](#source-1) ### November 11, 2026 — Briefing updated This briefing was last reviewed and updated on November 11, 2026. ## Threat Group & Attack Vector The university believes an unauthenticated update function allowed malicious-program placement. It also identified exploited, unpatched weaknesses in an unsupported operating system. No specific vulnerability was named. [1](#source-1) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1190 — Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190/): weaknesses in the public website server enabled intrusion. [1](#source-1) ## Response The website moved to another server, still-used passwords were being changed, and authorities were informed. The university planned external investigation and removal of obsolete programs and data. [1](#source-1) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### Kyoto University of Foreign Studies legacy website server unauthorized-access notice official · Kyoto University of Foreign Studies · Nov 10, 2026
Evidence ledger Review the supporting structured claims. 1. **Resulted In · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: Intrusion begins according to later investigation 2. **Resulted In · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: An intruder could control the old website server from October 21 until its October 30 disconnection. Logs showed bulk file reads, but external removal and misuse were not confirmed. 3. **Resulted In · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: The university reported to education and privacy authorities, consulted police and informed JPCERT/CC; it planned removal of obsolete programs/data and retirement or updating of unsupported systems. 4. **Resulted In · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: The university believes an unauthenticated website-update function allowed malicious-program placement; an unsupported operating system had unpatched weaknesses that were exploited. Retained obsolete programs and data increased the impact. 5. **Resulted In · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: The server was isolated, the website moved to a non-executing form on another server, and still-used passwords were being changed. The university found no intruder logins to its email accounts and planned external specialist investigation. 6. **Resulted In · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: Potential exposure involved 5,376 deduplicated people across university, junior-college, vocational-school, high-school and alumni records, mainly collected during 2000–2017. Category counts overlap. 7. **Disclosed At · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: 2026-11-10 8. **Discovered At · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: 2026-10-30 9. **Occurred At · 100% confidence · current** Potential personal-data exposure disclosed: 2026-11-10 10. **Resulted In · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: Fields included names, contact details, student numbers, employers, schools and academic years; some birth dates and health-related absence explanations were present. Credit-card data was excluded. 11. **Began At · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: 2026-10-21 12. **Occurred At · 100% confidence · current** Intrusion begins according to later investigation: 2026-10-21 13. **Resulted In · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: Intrusion detected and old server isolated 14. **Used Attack Technique · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: https://attack.mitre.org/techniques/T1190/ 15. **Affected Organization · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: Kyoto University of Foreign Studies 16. **Resulted In · 100% confidence · current** Kyoto University of Foreign Studies legacy-server intrusion: Potential personal-data exposure disclosed 17. **Occurred At · 100% confidence · current** Intrusion detected and old server isolated: 2026-10-30