TL;DR
- 01What happened
On October 20, 2026, NEC disclosed that a company it contracts for development and maintenance was attacked in late September, that stolen credentials were used to break into customer systems, and that files with personal data leaked from cloud storage the parties shared. The next day Osaka University disclosed a leak affecting 77,851 people, and Osaka Metropolitan University traced its outage from October 2 to the same attack.
- 02Why it was hard to tell
The account was legitimate and the files sat in the usual shared location, so it looked like ordinary work. According to Osaka University, a partner never reported to the university was involved; files were shared with it on cloud storage without basis in the contract, and files that should have been deleted were kept.
- 03The missing layer
NEC reported the download to Osaka University 13 days after the files were taken. What failed was the layer that checks, before handing data over, who it will be shared with.
What happened
- The contract chain
- Osaka University contracts NEC to run its university-wide education computer system (the “campus system”); Osaka Metropolitan University contracts NEC to maintain and run its core systems. NEC contracted system development and maintenance to another company (the contractor), which has not been named.
- The attack
- The contractor was attacked in late September and stolen credentials for a legitimate account were abused. Customer systems were accessed from the contractor’s device using that account, and files on servers were encrypted (per NEC). How the credentials were stolen, what rights the account had and whether multi-factor authentication was used have not been disclosed.
- Leak from shared storage
- Files leaked from cloud storage NEC created and used to share information between customers and NEC, and between NEC and its contractor. They included customers’ personal data and system information (per NEC). How the files were downloaded has not been disclosed.
- Osaka University (leak only)
- On September 26, 2026, a third party downloaded files containing the university’s personal data. Osaka University says its subsequent inquiry confirmed that a partner company not reported to the university was involved in part of the work, that files were shared on cloud storage to work with that partner without basis in the contract, and that files that should have been deleted after the work were kept. NEC’s investigation found no sign of intrusion into the campus system.
- What leaked at Osaka University
- 77,851 people (deduplicated: 59,014 alumni, 15,035 students, 3,802 staff). Name, university personal ID, university-issued email address, student or staff number, affiliation and more; the fields vary by person. No misuse or secondary harm has been confirmed (per Osaka University).
- Osaka Metropolitan University (encryption and leak)
- Its information infrastructure went down on October 2. The cause was unauthorized access to its systems using a legitimate account held by the subcontractor. It was also told that personal data and system information about the university in the cloud storage had leaked, but says the content and count are still being confirmed with NEC (per Osaka Metropolitan University).
- NEC’s disclosure
- It does not describe the partner’s involvement or how the files came to be shared. It says “multiple” customers were affected (press reports say three, with personal data leaked at two).
Glossary
Contractor — The company NEC contracts for system development and maintenance. It was attacked in late September. Osaka Metropolitan University calls it a "subcontractor". It has not been named.
Partner company — The company Osaka University says was "not reported to the university". According to Osaka University, files were shared to work with it. Whether it is the same company as the attacked contractor has not been disclosed.
Cloud storage — An online place to keep files and share them with others. Anyone the files are shared with can read them.
The stopping point is ①. Had anyone checked, before placing the files in shared storage, whether the party was allowed under the university's contract, the files would not have been shared with the partner (how they were taken has not been disclosed).
Without contractual basis, per Osaka University.
Per Osaka University.
Osaka University's files on 09-26.
Down on 10-02.
Timeline — disclosure and response
- In late September, NEC’s contractor is attacked (per NEC).
- A third party downloads files containing Osaka University’s personal data (per Osaka University).
- Early in the morning, Osaka Metropolitan University’s maintenance vendor sees servers stopping and contacts the university, which reports to the education ministry, police and others (OMU press materials).
- Osaka Metropolitan University holds a press conference and contacts the Personal Information Protection Commission.
- NEC tells Osaka University that files had been downloaded.
- NEC discloses. The same day, NEC reports the cause of the outage to Osaka Metropolitan University.
- Osaka University and Osaka Metropolitan University (5th update) disclose.
The facts rest on the disclosures by NEC, Osaka University and Osaka Metropolitan University (all primary). The partner’s involvement and how the files came to be shared appear only in Osaka University’s disclosure; NEC’s statement does not mention them. No disclosure says whether the partner and the attacked contractor are the same company. Osaka Metropolitan University says the roughly 130,000 academic-system records it said on October 5 may have leaked were on its own virtualisation platform and are separate from the information in NEC’s cloud storage. The number of customers comes from press reports.
After disclosure
- NEC: Is lending NEC-managed devices to the contractor among other measures, and will tighten contractor and personal-data management. It will report details of the leaked personal data to customers as they become clear.
- Osaka University: Will tell each affected person which fields leaked, and warns about phishing and spoofed email. It will press NEC to find the cause and carry out preventive measures.
- Osaka Metropolitan University: Will gather information with NEC and take the necessary steps.
Why it wasn’t stopped
This case was not only about a contractor’s credentials being stolen. Nothing let the university, as the outsourcing side, check who its data was shared with and when it was deleted.
Nothing let the outsourcing side check, before handing data over, who it would be shared with and when it would be deleted.
Proof here means checking, before a file is placed, that "this party may receive it", and recording that. Detection means noticing after files are taken or encrypted.
already taken
Detection worked, but only after the files were taken. The files could be placed in shared storage, yet no one checked whether the party could handle the university’s data; because they could be placed, they were shared, and they stayed after the work ended. That distance is the detection–proof gap, and it is a structural one.
The same structure appears in the Awa Bank test environment (customer data was left in an environment that should have been finished with).
How to counter this
Let the data owner decide who entrusted data may be shared with and where it may be kept, and check before sharing. Writing subcontracting approval into the contract does not control who actually touches the data. Each time a file is placed in shared storage, check whether the party is on the approved list, and refuse it if not. Delete when the work ends, and record the deletion.
Industries and operations to watch
- IndustryGovernment & public sector
- Universities, local governments and others that outsource system operations to IT vendors. From the outsourcing side, subcontracting beyond the vendor is invisible, and it is hard to know how many companies the data has reached.
- IndustryProcurement & supply chain
- IT vendors that hand development and maintenance to partners. Each customer’s data gathers in shared locations for the work.
- OperationLookup & data access
- Contractors and partners receiving data and deleting it after the work. Sharing and deletion are decided only by the contractor’s own practice.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Contractual approval of subcontracting | Ineffective | A partner not reported to the university was involved in the work (per Osaka University). |
| Rules to delete data after the work | Ineffective | Files that should have been deleted were kept (per Osaka University). |
| Managing contractor devices | Partial | NEC is lending its own managed devices to the contractor. That narrows entry via contractor devices, but does not change who files are shared with. |
| Intrusion detection | Partial | It notices after encryption or download. |
- Let the owner decide which companies may handle each dataset. Keep a list, on the owner’s side such as the university, of the contractors and subcontractors the contract allows. Do not rely on the contractor’s own declaration.
- Check before placing data in a shared location. Check whether the party is on the list, and refuse sharing if not. Give files an end-of-work date and delete them once it passes.
- Record who data was shared with and when it was deleted. Keep it separately from the contractor’s report, in a form that can later be shown to a third party: in other words, as proof.
Three things to confirm in your organisation about outsourced system operations
- When a contractor subcontracts, are you notified in advance, and is there a step to approve it?
- Is your personal data sitting in the shared storage your contractor uses to exchange files? If so, have you asked who can see it?
- Can the contractor show you, by record, that data was deleted when the work ended?
Note: if the approved list is itself wrong, wrong sharing still goes through. And if an allowed contractor’s legitimate account is taken over, data given to parties on the list can be read. How the credentials were stolen and how the files were downloaded have not been disclosed yet. If follow-up reports reveal them, this Brief will be revised.
Sources
- Primary, company disclosureNEC Apology for customer system outages and data leakage caused by unauthorized access at a contractor
- Primary, disclosureOsaka University Personal data leak at a contractor
- Primary, disclosureOsaka Metropolitan University Outage of the university’s information infrastructure, 5th update: system outage and data leak from the cyberattack disclosed by the contractor
- Primary, press conference handoutOsaka Metropolitan University Press conference handout
2 more (reporting, analysis)
- PressNikkei NEC contractor hit by cyberattack, three customers’ data leaked
- Press@IT Osaka Metropolitan University ransomware traced to an attack on NEC’s contractor; legitimate account stolen
References: “The last layer left for cyber defense in the age of AI”