Summary
- Environment: NEC contractor access, university systems and shared cloud storage
- Operational impact: Osaka Metropolitan University outage; University of Osaka files exposed
- Financial impact: No quantified incident cost established
- Record status: Developing record. Reviewed October 22, 2026; updated as evidence emerges.
What happened
Osaka Metropolitan University said a compromised NEC subcontractor’s legitimate account caused its October 2, 2026 system outage. It also confirmed leakage of university information from NEC-managed cloud storage. [1]
The University of Osaka, a separate institution, reported that a third party downloaded its files from NEC cloud storage on September 26. [2]
Impact
The University of Osaka identified 77,851 distinct people: 59,014 graduates, 15,035 students and 3,802 staff. Exposed fields varied and included names, university identifiers, email addresses and affiliations. [2]
Osaka Metropolitan’s confirmed cloud-storage leak remained unquantified. Its previously discussed approximately 130,000 academic records were on a different platform; whether those records leaked was still under investigation. The populations must not be added together. [1]
Timeline
University of Osaka files downloaded
The date later reported in the university’s disclosure.
[2]Osaka Metropolitan system outage
The university later linked the outage to subcontractor-account access.
[1]University of Osaka notified
NEC reported the file download to the university.
[2]Contractor access path reported
NEC told the university its subcontractor had been attacked in late September.
[1]University disclosures published
Osaka Metropolitan issued its fifth notice; the University of Osaka issued its disclosure.
[1][2]Briefing updated
This briefing was last reviewed and updated on October 22, 2026.
Threat Group & Attack Vector
The subcontractor’s legitimate account enabled access to Osaka Metropolitan’s systems. The original intrusion method remains undisclosed. [1]
The University of Osaka said NEC shared and retained its files outside the contractual basis for the work. It said investigators found no related intrusion into its own educational computing system. [2]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1078 — Valid Accounts: use of the subcontractor’s legitimate account to enter Osaka Metropolitan’s systems. [1]