Saga University, a national university in Saga, Japan, said on 30 October that personal data on about 80,000 students, staff and former members may have leaked in a ransomware attack. Patient records from its university hospital may also have leaked. The Yomiuri Shimbun reported the announcement, which came at a press conference. The university confirmed that someone tried to extort it but did not give details. It has reported the incident to Japan's education ministry (MEXT) and is working with Saga Prefectural Police to find out how the attackers got in. Two weeks before the announcement, The Gentlemen ransomware group listed the university on its leak site, according to ransomware tracking feeds. The university has not publicly confirmed which group was responsible.
What Happened
The Saga Shimbun pieced together the timeline from the university's own updates:
- 24 September, 08:42: Administrative staff reported that files on a network storage device (NAS) used by the administrative division were encrypted. The university took the NAS off the network, collected affected computers and stopped other infections from spreading.
- 24 to 27 September: About 500 administrative computers were taken out of use as a precaution. They came back into use at 11:03 on 27 September.
- 25 September: The university announced the incident publicly. It said it had found no impact on systems used for teaching, research or clinical care.
- 28 September: Normal administrative work resumed. The same day, the university said staff and student login details (IDs and passwords) may have leaked, and told everyone to change their passwords. It said it had seen no misuse of those details. President Koichi Node called the incident "extremely serious."
- 9 October: Online requests for certificates and documents were still suspended, according to Innovatopia.
- 14 to 16 October: The Gentlemen added saga-u.ac.jp to its leak site. HookPhish and Nightwatch, which use Ransomware.live data, record the listing date as 14 October and their detection as 16 October.
- 30 October: The university announced that data on about 80,000 people, plus hospital patient information, may have leaked.
One point is unclear. The university first said clinical systems were not affected, but it later said patient data was at risk. Its public statements do not explain whether patient data was kept on the administrative storage or how it was exposed.
What Was Taken
The university says it cannot rule out a leak. It has not said that a leak has been confirmed. Reports describe the affected data a little differently:
- About 80,000 current and former students, staff and related people: The Yomiuri Shimbun lists names, dates of birth, addresses and phone numbers. ITD, a Japanese guidance site that bases its articles on the university's notices, lists names, addresses, phone numbers, email addresses and passwords. Neither report says how the passwords were stored.
- Patients of Saga University Hospital: Names and dates of birth, plus visit history: clinical department, disease or injury name and date of visit. No report gives the number of affected patients.
- Login credentials: Since 28 September, the university has warned that staff and student IDs and passwords for its internal systems may have leaked.
The Gentlemen's leak site listing has not been independently checked against the university's figures. It is not known whether any data has been published.
Why It Matters
Japanese universities that run hospitals hold large and very sensitive datasets. They mix student and staff records with medical histories, often on shared administrative systems. Diagnosis data combined with home addresses and phone numbers is especially useful for convincing phishing or extortion aimed at patients. The 80,000 figure is far larger than the university's current student and staff numbers, which suggests that records of former students and staff were still being kept and were within the attackers' reach.
The incident also shows the double extortion pattern. The university said it was threatened, and a leak site listing followed. This means that restoring encrypted files does not end the incident. Commentators also pointed out that the outage of about 500 computers was a defensive choice. The machines were not shown to be encrypted, and business continuity plans should cover that kind of shutdown too.
The Attack Technique
The university has not said how the attackers got in, and the police investigation is ongoing. What is known is that encryption hit an administrative NAS and that login credentials were probably exposed. Several other Japanese ransomware cases from the same weeks, as reported by Innovatopia, began with abused VPN accounts or exposed remote desktop access. Nothing published so far links Saga University's intrusion to either method. The Gentlemen is a ransomware-as-a-service operation that has been active in 2025 and 2026. It typically steals data first and then encrypts it.
What Organizations Should Do
- Delete old records. Set and enforce retention limits for data on former students, staff and patients. Data that has been deleted cannot be stolen.
- Keep clinical data off administrative storage. Make sure patient information is not copied onto general office file shares or NAS devices, and audit for copies that already exist.
- Assume credentials are compromised after any intrusion. Force password resets, require multi-factor authentication on every remote access route, and watch for logins with leaked accounts.
- Harden NAS and remote access. Patch storage devices, remove direct internet access to them, and check VPN and RDP accounts for unused or shared logins.
- Watch for outbound data transfers. Large transfers from file servers can be spotted before encryption starts.
- Plan for defensive shutdowns. Decide in advance who can take systems offline and which processes, such as payroll, certificate requests and patient communications, must keep running.
Sources: Saga University Ransomware: 80,000 People's Data ITD | 【解説】ファインズ約154万件・池上通信機・佐賀大学・八王子学園・両毛システムズなど、ランサムウェアと予約システムの公表・続報7件を整理 | Ransomware Group thegentlemen Hits: Saga University | A computer does not have to be encrypted for its user’s work to sto... | 佐賀大学にサイバー攻撃、学生や教職員ら８万人分の個人情報流出か…医学部付属病院の患者情報も流出恐れ：地域ニュース : 読売新聞 | 佐賀大学のランサムウエア被害 ユーザー認証情報流出か 使用は確認されず 行政・社会 佐賀県のニュース 佐賀新聞 | 🏴☠️ Thegentlemen has just published a new victim : Saga University... | 佐賀大学の事務情報システムでランサムウエアによる被害発生 NAS内でファイルが暗号化 行政・社会 佐賀県のニュース 佐賀新聞