Suspected ransomware takes down about 500 servers at Osaka Metropolitan University
Osaka Metropolitan University cancelled classes after a suspected ransomware attack stopped about 500 servers, Japanese media reported. Records on at least 130,000 current and former students, faculty and others may be exposed, though the university has not confirmed any theft.
The Watch · Security desk
What happened
- Systems for academic administration, educational support, financial accounting, payroll, human resources and library services went down, along with the websites and internal network.
- OMU says it believes ransomware caused the outage and is investigating the attack with outside cybersecurity specialists.
- The university has reported the incident to Japan's data protection authority and other government agencies.
- Classes are cancelled through at least Thursday, with in-person teaching due to resume Friday and online classes restarting as system recovery allows.
Why it matters
- Who's exposed exposure The possible exposure goes beyond OMU's own rolls to data tied to Osaka Prefecture University and Osaka City University, so people whose records date from before the 2022 merger may be in the affected set.
- What's now possible capability If the data was taken, names, addresses and email addresses give an attacker enough to send phishing addressed to each person by name.
- What it limits constraint With no attacker named and no ransom demand disclosed, other Japanese institutions have no group or indicators from this incident to check against their own networks.
Next story · Security · 8h ago
Semperis survey puts threats against ransomware victims' staff at 40% of attacksConfirmed2 publishers
OMU is one of Japan's largest universities [15], and some of its services kept running. Entrance exam applications and enrollment procedures stayed available because they are hosted on external servers, according to the university [17]. The electronic medical record system at the university hospital was not affected, and the hospital kept providing medical services [18]. The veterinary clinical center also stayed open [18].
Both figures that size the attack are second-hand. Japanese media reported the 500 stopped servers and the 130,000 possibly exposed people, citing university officials at a press conference on Monday [16][6]. In its own statement on Tuesday, OMU said its internal network and email were down [2]. It also said it was still investigating whether any information had leaked [9].
The outage began late last week, according to The Record [1]. The report does not describe how the attackers got in.
On the published record, this is a single incident. It comes as several other Japanese organisations have disclosed breaches, and The Record reports no evidence that they are connected [12]. Over the weekend Nikkei disclosed that a compromised employee account had sent about 9,000 malicious emails to contacts inside and outside the company, some of whom were sources for its journalism [13]. Brokerage Daiwa Securities, the delivery companies Yamato Transport and Sagawa Express, insurer Dai-ichi Life and broadcast equipment maker Ikegami Tsushinki have also disclosed incidents recently [14].
What to watch
- A ransomware group claiming OMU or posting its data, which would confirm theft and give defenders a named actor to track.
- The outside investigators' finding on whether personal data left the network, and any notice sent to the people affected.
- Whether online classes and the payroll, HR and accounting systems are back when in-person teaching resumes on Friday.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Osaka Metropolitan University canceled classes and shut down a large part of its IT infrastructure following a suspected ransomware attack that began late last week.
- [2]
Osaka Metropolitan University said on Tuesday that the outage left its internal network, email and a range of administrative and academic systems unavailable.
- [3]
The outage affected systems used for academic administration, educational support, financial accounting, payroll, human resources and library services, as well as the university's websites and internal network.
- [4]
OMU said it believes ransomware caused the disruption and is investigating the attack with outside cybersecurity specialists.
- [5]
OMU has not identified the attackers or said whether it received a ransom demand.
- [6]
Reports said information belonging to at least 130,000 current and former students, faculty members and others associated with the university may have been exposed.
- [7]
The potentially affected information includes names, addresses and email addresses.
- [8]
The potentially affected information includes data linked to Osaka Prefecture University and Osaka City University, which merged in 2022 to form OMU.
- [9]
The university has not confirmed that personal data was stolen and said Tuesday that it was still investigating whether any information had been leaked.
- [10]
OMU has reported the incident to Japan's data protection authority and other government agencies.
- [11]
The disruption forced OMU to cancel classes through at least Thursday; the university plans to resume in-person classes Friday, while online classes will restart depending on the progress of system recovery.
- [12]
The incident comes amid several recently disclosed cyber breaches in Japan, although there is no evidence that they are connected.
- [13]
Over the weekend, Nikkei disclosed that a compromised employee account had been used to send roughly 9,000 malicious emails to internal and external contacts, including journalistic sources.
- [14]
Other Japanese companies that have recently disclosed cyber incidents include brokerage Daiwa Securities, delivery companies Yamato Transport and Sagawa Express, insurer Dai-ichi Life and broadcast equipment manufacturer Ikegami Tsushinki.
- [15]
Osaka Metropolitan University is one of Japan's largest universities.
- [16]
About 500 servers stopped operating following the attack, Japanese media reported, citing university officials at a press conference Monday.
- [17]
Systems used for entrance exam applications and enrollment procedures remain available because they are hosted on external servers.
- [18]
The attack did not affect the electronic medical record system at the university hospital, which continued providing medical services; the veterinary clinical center also remained operational.
Sources
2 independent publishers whose own reporting we read for this story.
- thecyberexpress.comOsaka Metropolitan University Hit by Ransomware, 130,000 Records at Risk
1 article · October 6, 2026
- therecord.mediaOsaka Metropolitan University cancels classes after suspected ransomware attack
1 article · October 6, 2026
Topics and entities
Entities
- Daiwa Securities
- Nikkei
- Personal Information Protection Commission
- Yamato Transport
- JPCERT/CC
- Osaka Metropolitan University
- Ikegami Tsushinki