NEC, one of Japan's largest IT services companies, said on October 20, 2026 that a company it hires for system development and maintenance was hit by a cyberattack in late September. In its own Japanese-language notice, NEC said the attackers stole legitimate account credentials from the contractor. They then used those accounts from the contractor's own terminals to get into NEC customers' system environments and encrypt files on their servers, which left "various systems" unusable. Files were also stolen from a cloud storage service that NEC used to share project information with customers and contractors. Some of those files held customers' personal data. NEC has not named the contractor or any affected customer. It also has not said how many records were exposed or how far recovery has progressed. Two outlets give a narrower count of victims. The Yomiuri Shimbun reports that information from three customer companies leaked, and that two of them lost personal data. Japan Cyber Watch, citing Nikkei and Yomiuri, gives the same figures. Japan Cyber Watch also reports that Osaka Metropolitan University has said it is one of the affected customers, and that about 500 of its servers stopped on October 2. NEC has not confirmed that.
What Happened
NEC's notice ("委託先への不正アクセスに起因するお客さまのシステム障害、情報漏えいに関するお詫び") is short. ITmedia NEWS (via Yahoo! News Japan) and ASCII.jp both repeat its key points:
- Initial compromise: An unnamed contractor that does system development and maintenance for NEC was attacked in late September 2026.
- How customers were reached: Legitimate account credentials stolen from the contractor were used to access customer system environments from the contractor's terminals. ASCII.jp's translation describes this as the attackers abusing "the legitimate access methods used for maintenance."
- What it did to customers: Files on servers were encrypted, so various systems could not be used. NEC's notice does not use the word "ransomware," but the description fits a ransomware-style encryption attack.
- Data theft: Files that NEC created and stored in a shared cloud storage service were taken. NEC used that service to share information between customers and NEC, and between NEC and its contractors.
- Notification: NEC says it has already contacted the affected customers individually.
How many victims: The sources do not give the same number. NEC's notice says only "multiple customers" (複数のお客さま). The Yomiuri Shimbun reports three customer companies with leaked information, two of them including personal data. CIO Monitor, citing BigGo Finance, repeats the three-company figure. NEC itself has not published a number.
Osaka Metropolitan University: Only Japan Cyber Watch, among these sources, names the university as a victim. It reports that the university said it was affected and that about 500 servers went down on October 2. NEC has named no customers, so readers should treat this as reported rather than confirmed by NEC.
Timeline: Late September (contractor compromised) → October 2 (university outage, per Japan Cyber Watch) → October 20 (NEC public disclosure). That is roughly three weeks between the first compromise and public disclosure.
What Was Taken
NEC confirms that files were stolen from the shared cloud storage and that they contained:
- Personal information held by NEC's customers
- System-related information about customer environments
NEC says it will report the details of the leaked personal data to each customer once they are identified. The Yomiuri reports that the number and content of the leaked records are still under investigation. None of the sources gives a record count, so no figure is available.
The "system-related information" may matter as much as the personal data. Project files shared between an integrator, its contractors and its customers often include network diagrams, host lists, configuration details and sometimes access procedures. That kind of material is useful for a follow-on attack on the same customers, even after the stolen contractor accounts are revoked.
Why It Matters
This is a textbook trusted-relationship compromise. The attackers did not need to break into NEC itself or into the customers' perimeters. They took over a lower-tier supplier whose maintenance access was already trusted, and then used that access exactly as it was designed to be used.
Several points stand out for defenders:
- Japan's layered outsourcing model spreads the risk. Large system integrators like NEC routinely pass development and maintenance work down to subcontractors. Japan Cyber Watch argues that every subcontractor account that can reach a customer's systems becomes part of that customer's attack surface. Many customers do not know who those subcontractors are.
- Maintenance access defeats perimeter controls. Activity from a known contractor terminal using a valid account looks normal. The encryption was probably the first obvious sign of the intrusion.
- Shared collaboration storage is a single point of exposure. One cloud repository shared across customers, the integrator and contractors meant that compromising one party exposed data belonging to several customers.
- NEC's fix points to the root cause. After the incident was discovered, NEC began lending NEC-managed terminals to the contractor. This suggests the contractor's own endpoints, which NEC did not control, were the weak point. NEC also says it will tighten its management of contractors and of personal data.
Public-sector and education customers should pay particular attention. A university losing hundreds of servers at once, as reported for Osaka Metropolitan University, shows how far one supplier's compromise can reach.
The Attack Technique
What is known, per NEC's notice:
- The contractor's environment was compromised in late September (initial access vector not disclosed).
- Legitimate account credentials were stolen (credential access).
- Those accounts were used from the contractor's own terminals to access customer environments (valid accounts and trusted relationship abuse, MITRE ATT&CK T1078 / T1199).
- Files on customer servers were encrypted (data encrypted for impact, T1486).
- Files in a shared cloud storage service were taken (data from cloud storage, T1530).
What is not known: the threat actor, any ransomware family, whether a ransom was demanded, how the contractor was first breached, and how long the attackers had access before the encryption. CIO Monitor notes that the attack vector, the actor and the number of records all remain undisclosed.
A note on CVE-2026-16876: In early September 2026, NEC published a critical authentication bypass (CVSS v4.0 9.3, CWE-306) in the WebGUI of its UNIVERGE IX-R/IX-V routers. The flaw lets an unauthenticated attacker run arbitrary CLI commands over the internet. None of the sources connects this vulnerability to the contractor compromise. We mention it only because the timing is close and because organisations running affected UNIVERGE versions (Ver1.1 to 1.3, 1.4.21 to 1.4.28, and 1.5.23) should patch whatever the cause of this incident turns out to be.
What Organizations Should Do
- List every third-party account that can reach your systems. That includes the subcontractors of your integrator, not just the integrator. Ask your prime vendor in writing which companies and which accounts hold maintenance access to your environment.
- Require managed, attested endpoints for vendor access. NEC is now doing this by lending its own terminals to the contractor. Only allow remote maintenance from devices you or your prime contractor control and monitor, through a broker with session recording.
- Make contractor access just-in-time and phishing-resistant. Turn standing maintenance accounts into time-limited access that someone has to approve. Enforce phishing-resistant MFA, and make each account reach only the systems on its contract.
- Isolate the vendor access path quickly when a supplier is breached. As NHIMG's guidance stresses, the first steps are to disable the remote access path, revoke credentials, tokens and sessions, and then hunt for lateral movement. Do not wait for the supplier to confirm whether your environment was touched.
- Audit shared project storage. Find out which collaboration repositories hold your personal data, system diagrams or credentials. Require separate storage for each customer and minimal retention, and remove any secrets from shared files.
- Keep offline, immutable backups and practise restoring at scale. Encryption through trusted maintenance access can reach the same administrative layer your backups depend on. Keep at least one backup copy that maintenance accounts cannot reach.
Sources: NEC Contractor Hacked: Stolen Accounts Used to Encrypt Customers' S... | NEC Subcontractor Attack Highlights Supply-Chain Risk — CIO Monitor | What should security teams do first after a contractor remote-acces... | CVE-2026-16876 - CVE.report | NEC Contractor Hit by Cyberattack, Causing System Outages for Multi... | NECの委託先にサイバー攻撃 正規アカウント悪用し顧客のサーバ暗号化、個人情報の漏えいも（ITmedia NEWS） - Yahoo!... | 委託先への不正アクセスに起因するお客さまのシステム障害、情報漏えいに関するお詫び NEC | ＮＥＣ委託先にサイバー攻撃、顧客企業３社の情報が漏えい…２社では個人情報漏えいを確認 : 読売新聞