大阪大学Data breach / unauthorized access incident
- Occurred on
- September 26, 2026
- Announced on
- October 21, 2026
- Severity
- AFinancial and HR records — information that easily translates into monetary damage.
- Scale
- 77,851 people
- Main impact
- Files that NEC had shared on cloud storage were downloaded by a third party, and it was confirmed that personal data of 77,851 people (alumni, current students, and faculty/staff) — including names, university IDs, and university-issued email addresses — were included.
- Information involved
- Full nameUser / member IDEmail address
- Cause / key point
- The leak resulted from NEC, which is contracted to operate the university-wide educational computing system, sharing files on cloud storage without contractual authorization, and those files being downloaded by a third party.About Supply chain attacks (via vendors & shared services)
- Industry
- Education
- Listing / capital
- Government / public body
- Sources
- Last updated
- October 22, 2026
Is this incident worth paying attention to?
Written & reviewed

Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.
CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.
Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:
Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction
Related incidents
Browse the database →Incidents sharing the same company, service, attack method or industry (grouped automatically from the disclosures).
Incidents related to "クラウドストレージ"
Incidents where the damage spread through the same service or system.
Incidents related to "ダウンロード"
Incidents where the damage spread through the same service or system.
Same attack method
- S第一興商(ビッグエコー等)2026.10.08 announced・Affected 8,631,000 records
- A旭化成セラピューティクス(Pharma DIGITAL)2026.10.06 announced・Affected 514,000 people
- A大和証券2026.10.05 announced・Affected 220,000 records
- CTOPPAN(損保ジャパン)2026.09.29 announced・Affected 177,426 people
- A大東ガス株式会社2026.09.28 announced・Affected 124,000 records
- A福岡大学(SMART SPI)2026.07.09 announced・Affected 33,668 people
Same industry
- Sちとせグループ(ちとせアカデミー)2026.10.09 announced・Affected 843 people
- S山口大学(教職員メール)2026.10.06 announced・Affected 1 accounts
- S大阪公立大学2026.10.05 announced・Affected Unknown
- S日本エネルギー経済研究所2026.10.02 announced・Affected 13 records
- S日本原子力研究開発機構(研究支援サイト)2026.10.01 announced・Affected 175 people
- S大阪市立小学校(成長・肥満度曲線)2026.09.09 announced・Affected 18 people
Attack method classification: Supply chain attacks (via vendors & shared services)(Compromising the provider instead of the user)
Read the Supply chain attacks (via vendors & shared services) guide and national trends →