--- title: "NEC contractor compromise affecting Osaka universities" description: "A compromised NEC contractor account caused Osaka Metropolitan University’s outage; a separate university reported 77,851 people affected by leaked files." incident_type: "Data incident" status: "active" last_modified: "2026-10-22" canonical_url: "https://www.ally.security/incidents/nec-contractor-osaka-universities-compromise-2026" markdown_url: "https://www.ally.security/incidents/nec-contractor-osaka-universities-compromise-2026.md" stix_url: "https://www.ally.security/incidents/nec-contractor-osaka-universities-compromise-2026/stix.json" --- # NEC contractor compromise affecting Osaka universities Two Osaka universities disclosed different consequences of the same NEC contractor incident, including system access and leaked cloud-storage files. Last modified Oct 22, 2026 · 2 sources ## Summary - **Environment:** NEC contractor access, university systems and shared cloud storage - **Operational impact:** Osaka Metropolitan University outage; University of Osaka files exposed - **Financial impact:** No quantified incident cost established ## What happened [Osaka Metropolitan University](https://www.omu.ac.jp/) said a compromised [NEC](https://jpn.nec.com/) subcontractor’s legitimate account caused its October 2, 2026 system outage. It also confirmed leakage of university information from NEC-managed cloud storage. [1](#source-1) [The University of Osaka](https://www.osaka-u.ac.jp/), a separate institution, reported that a third party downloaded its files from NEC cloud storage on September 26. [2](#source-2) ## Impact The University of Osaka identified 77,851 distinct people: 59,014 graduates, 15,035 students and 3,802 staff. Exposed fields varied and included names, university identifiers, email addresses and affiliations. [2](#source-2) Osaka Metropolitan’s confirmed cloud-storage leak remained unquantified. Its previously discussed approximately 130,000 academic records were on a different platform; whether those records leaked was still under investigation. The populations must not be added together. [1](#source-1) ## Timeline ### September 26, 2026 — University of Osaka files downloaded The date later reported in the university’s [disclosure](https://www.osaka-u.ac.jp/ja/news/topics/2026/10/21004). [2](#source-2) ### October 2, 2026 — Osaka Metropolitan system outage The university later linked the outage to subcontractor-account access. [1](#source-1) ### October 9, 2026 — University of Osaka notified NEC reported the file download to the university. [2](#source-2) ### October 20, 2026 — Contractor access path reported NEC told the university its subcontractor had been attacked in late September. [1](#source-1) ### October 21, 2026 — University disclosures published Osaka Metropolitan issued its [fifth notice](https://www.omu.moe/news/2026-10-21-1d69aecb.html); the University of Osaka issued its [disclosure](https://www.osaka-u.ac.jp/ja/news/topics/2026/10/21004). [1](#source-1) [2](#source-2) ### October 22, 2026 — Briefing updated This briefing was last reviewed and updated on October 22, 2026. ## Threat Group & Attack Vector The subcontractor’s legitimate account enabled access to Osaka Metropolitan’s systems. The original intrusion method remains undisclosed. [1](#source-1) The University of Osaka said NEC shared and retained its files outside the contractual basis for the work. It said investigators found no related intrusion into its own educational computing system. [2](#source-2) ### Actors - No threat actor group has been identified in the reviewed public evidence. ### TTPs - [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/): use of the subcontractor’s legitimate account to enter Osaka Metropolitan’s systems. [1](#source-1) ## Response Osaka Metropolitan was seeking details of the cloud-storage leak from NEC. [1](#source-1) The University of Osaka demanded investigation and prevention measures and planned individual notifications. It had not confirmed misuse of the leaked information. [2](#source-2) ## Assets [Download the case-scoped STIX 2.1 bundle]() ## Sources Primary source records used to research this incident. ### 本学情報基盤システムにおける障害の発生について【第5報】 official · Osaka Metropolitan University · Oct 21, 2026 ### 委託事業者における個人情報漏えいについて official · The University of Osaka · Oct 21, 2026
Evidence ledger Review the supporting structured claims. 1. **Disclosed At · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: 2026-10-21 2. **Occurred At · 100% confidence · current** NEC notified the University of Osaka: 2026-10-09 3. **Vendor Of · 100% confidence · current** NEC Corporation: The University of Osaka 4. **Affected Organization · 100% confidence · current** Osaka Metropolitan University system compromise: Osaka Metropolitan University 5. **Vendor Of · 100% confidence · current** NEC Corporation: Osaka Metropolitan University 6. **Affected Individual Count · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: 77,851 7. **Resulted In · 100% confidence · current** Osaka Metropolitan University system compromise: Osaka Metropolitan University attributed its October 2 system outage to unauthorized access using a legitimate account held by NEC’s subcontractor. 8. **Resulted In · 100% confidence · current** NEC contractor compromise affecting Osaka universities: University of Osaka published its contractor-related disclosure 9. **Resulted In · 100% confidence · current** NEC contractor compromise affecting Osaka universities: Osaka Metropolitan University said NEC reported that an unnamed subcontractor was attacked in late September 2026 and its legitimate account was used to access the university system. 10. **Resulted In · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: The University of Osaka said NEC found no related unauthorized access to its own educational computing system and no misuse of the leaked information had been confirmed as of the notice. 11. **Resulted In · 100% confidence · current** Osaka Metropolitan University system compromise: Osaka Metropolitan University said NEC confirmed leakage of its personal and system information from NEC-managed cloud storage; the content and count remained under investigation. 12. **Resulted In · 100% confidence · current** Osaka Metropolitan University system compromise: NEC reported the subcontractor access path to Osaka Metropolitan University 13. **Occurred At · 100% confidence · current** University of Osaka published its contractor-related disclosure: 2026-10-21 14. **Resulted In · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: The University of Osaka reported 59,014 graduates, 15,035 current students and 3,802 staff among 77,851 distinct affected people. 15. **Occurred At · 100% confidence · current** NEC reported the subcontractor access path to Osaka Metropolitan University: 2026-10-20 16. **Resulted In · 100% confidence · current** NEC contractor compromise affecting Osaka universities: Osaka Metropolitan University system compromise 17. **Occurred At · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: 2026-09-26 18. **Resulted In · 100% confidence · current** NEC contractor compromise affecting Osaka universities: University of Osaka files downloaded from NEC cloud storage 19. **Resulted In · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: NEC notified the University of Osaka 20. **Occurred At · 100% confidence · current** Osaka Metropolitan University system compromise: 2026-10-02 21. **Resulted In · 100% confidence · current** Osaka Metropolitan University system compromise: The approximately 130,000 academic records mentioned at the October 5 briefing belonged to the university’s own virtualization platform, separate from the confirmed NEC cloud-storage leak; leakage from that platform remained unconfirmed. 22. **Resulted In · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: The University of Osaka asked NEC to address the incident, establish the cause and implement recurrence-prevention measures; individual data details would be notified later. 23. **Resulted In · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: The exposed fields varied by person and included names, university IDs, university email addresses, student or staff numbers and affiliation. 24. **Used Attack Technique · 100% confidence · current** Osaka Metropolitan University system compromise: https://attack.mitre.org/techniques/T1078/ 25. **Resulted In · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: The University of Osaka said NEC shared files with an undisclosed subcontractor without a basis in its contract and retained files that should have been deleted after the work. 26. **Affected Organization · 100% confidence · current** NEC contractor compromise affecting Osaka universities: NEC Corporation 27. **Affected Organization · 100% confidence · current** University of Osaka files downloaded from NEC cloud storage: The University of Osaka 28. **Disclosed At · 100% confidence · current** Osaka Metropolitan University system compromise: 2026-10-21