Leak of Personal Information by a Contractor

On October 9, 2026, NEC Corporation (hereinafter referred to as "NEC"), which has been contracted by the University of Osaka to operate its university-wide computer system for education, informed that a third party had downloaded files containing personal information held by the university on September 26, 2026.

A subsequent investigation revealed that a subcontractor that had not been reported to us was involved in part of the relevant operations. It was also confirmed that, without a contractual basis under its agreement with us, NEC had shared files containing personal information held by the university via cloud storage for the purpose of sharing information with the subcontractor. It was also confirmed that the subcontractor had retained the files in question despite being required to delete them upon completion of the work, and it was subsequently found that these files had been downloaded by a third party.

Related information: NEC's public announcement (Link in Japanese only)

■Personal Information Leaked
The number of individuals currently confirmed to have had their personal information leaked is 77,851 (excluding duplicates). The breakdown is as follows:

Alumni: 59,014
Current students: 15,035
Faculty and staff: 3,802

The types of personal information leaked vary depending on the individual affected, but the main items are as follows (The specific information affected for each individual will be reported later):
-Name
-UOsaka Personal ID
-UOsaka email address (e.g., OUMail account, etc.)
-Student or employee ID number
-affiliation

NEC's investigation found no evidence of unauthorized access related to this incident to the university-wide computer system for education.
At present, no misuse of the leaked information or secondary damage resulted from this incident has been confirmed. However, please remain vigilant against phishing emails, spoofed emails, and other attempts to misuse the leaked information.

We consider it a serious matter that a subcontractor not reported to us was involved in the relevant operation and that NEC shared and retained files containing personal information without a contractual basis with us. We deeply regret that, as a result, the personal information of members of UOsaka was leaked.
We sincerely apologize for the considerable concern and inconvenience this incident has caused to all those affected.
We will continue to urge NEC to take the necessary measures to resolve this incident, investigate its causes, and thoroughly implement measures to prevent recurrence.

【Contact Information】
Information and Communications Technology Services Infrastructure Division, Department of Information and Communications Technology Services, The University of Osaka
https://forms.cloud.microsoft/r/9hieJr8Qd3 (Link in Japanese only)