Waseda University confirmed on November 9, 2026, that an unidentified third party broke into the IT system that stores login details for MyWaseda, the university portal for email and other services, and took user records. The university gives two figures in the same notice. Its summary says "approximately 3,400" records were taken, and its detailed breakdown says 3,342. The data includes names, staff ID numbers, Waseda email addresses, department names, affiliation categories and password information that the university says was "stored in encrypted form." Waseda found the intrusion while checking its systems after a PHP vulnerability came to light. The break-in itself happened on August 31, 2026, more than two months before it was made public. No attacker has been named, and the university has not linked the incident to any of the other breaches at Japanese organisations this autumn.
What Happened
Waseda's notice says the incident came to light during a review of its IT systems' security, which it carried out because of a PHP vulnerability. During that review, staff found evidence of unauthorized access dated August 31, 2026. The university then widened its investigation. It confirmed two things: someone had got into the system that manages personal information, and that person had taken some of the data stored there.
The affected system is not the MyWaseda portal itself. It is the back-end store of user information that MyWaseda uses to authenticate logins. Waseda apologised to faculty, staff, students, alumni and other members of its community. We have not seen the university name the exact PHP flaw or say how the attacker moved from the first weakness to the personal information system.
There is a gap of about ten weeks between the August 31 intrusion and the November 9 disclosure. The university's account suggests it did not detect the intrusion when it happened and only found it by looking back after the PHP issue prompted a review.
What Was Taken
According to Waseda, the system holds staff ID numbers, names, Waseda email addresses, department names, affiliation categories and encrypted password information. The university splits the 3,342 confirmed records into two groups:
- 81 individual records belonging to current and former faculty and staff, students, alumni and others, taken in partial sets:
- Name and affiliation category: 38 records
- Name, affiliation category and Waseda email address: 23 records
- Name and encrypted password information: 20 records
- 3,261 user records belonging to staff members and others, each made up of six data items. Given what the system holds, these are likely the fuller identity records.
On the record count, the university's own headline figure is "approximately 3,400" and its itemised total is 3,342. The precise figure is 3,342. The rounder number appears to be an approximation, not a separate count.
The password data is the most sensitive item. Waseda says the passwords were "encrypted" but has not said publicly whether that means reversible encryption or one-way hashing, or which algorithm it used. That difference decides how easily the passwords could be recovered offline. The records also pair names with institutional email addresses and departments, which is useful material for convincing phishing aimed at university staff.
Why It Matters
Waseda's disclosure comes during an unusually heavy run of data theft incidents in Japan. ITmedia Business Online, citing a Trend Micro tally, reported 600 incidents disclosed by Japanese companies and government agencies by the end of September. That already exceeded the 593 recorded for all of the previous year. Japan's government held its first ministerial meeting on the problem on October 8.
Universities have been a clear target:
- The University of Osaka disclosed in October that files containing the personal information of 77,851 people (59,014 alumni, 15,035 current students and 3,802 faculty and staff) were downloaded by a third party on September 26. The university says its contractor NEC shared the files through cloud storage with a subcontractor the university had not been told about, with no contractual basis for doing so. The subcontractor then kept the files after it was supposed to delete them. NEC found no evidence that the university's own system was accessed.
- Osaka Metropolitan University had about 500 servers stop and most of its backups encrypted, according to incident responder Marek Gajewski's review of public disclosures.
- Cybernews reports that its researchers found an exposed attacker server showing a campaign against university sign-on systems. They identified at least 42 universities as potential targets and found records across 1,079 domains. The researchers say attackers exploited known flaws in QuickLaunch, a sign-on platform used by colleges. QuickLaunch says it found no evidence that its platform was compromised. Cybernews says Mandarin-language attack notes on the server point to a Chinese-speaking operator, but its researchers could not confirm where the attacker is based.
Outside education, the Wall Street Journal reported that GMO Cybersecurity by Ierae linked attacks on around 80 Japanese companies to Artex, an AI agent built by a Chinese engineer. Order and inventory platform WASABI SWITCH and FAQ vendor Scala Communications have also disclosed breaches. In Scala's case, Gajewski reports that an intruder was inside for about 11.5 hours and that data on roughly 110,000 Daiwa Securities customers was involved.
None of these reports names Waseda. Waseda has not attributed its intrusion, and no researcher or agency has publicly tied it to Artex, the QuickLaunch campaign or any other known activity. The broader point for defenders is that identity stores at universities, which hold large numbers of linked accounts and often run older web software, are now being targeted repeatedly. Several of these breaches were only found weeks after they happened.
The Attack Technique
Waseda has disclosed only that a PHP vulnerability led to the security review that uncovered the intrusion. It has not said whether that vulnerability was the way in. The account suggests a web-facing PHP application connected to, or able to reach, the system holding login data. The university has not confirmed this.
Across this autumn's Japanese incidents, JPCERT/CC issued an alert on October 8, expanded on October 9, describing the methods behind the run of personal data thefts. According to The Primary Wire's report on the alert, the methods include:
- Scanning targets for a range of known vulnerabilities
- Extracting access keys and server addresses embedded in public smartphone apps, then abusing APIs that never check who is calling them
- Exploiting a Metabase flaw (versions 58 through 63) that the U.S. has listed as actively exploited since August 11
- Breaching business-intelligence dashboards and internal employee-management systems, then taking the data stored in them
JPCERT/CC reportedly cautions that the cases do not share a single method and treats them as separate from routine ransomware. A Japanese security analysis blog that reviewed public disclosures sorts the entry points into three categories: broken authentication, flawed APIs and unpatched vulnerabilities. Waseda's case, as described, falls into the third.
What Organizations Should Do
- Inventory and patch PHP across your environment. Waseda found its breach only because a PHP flaw prompted a review. Find every internet-facing PHP application, including old departmental and research sites, and apply current fixes. Retire anything that cannot be patched.
- Hunt back in time, not just forward. When a serious vulnerability is announced, search logs for exploitation from before the patch date. Waseda's intrusion was 10 weeks old when it was found. Keep web and authentication logs long enough to make that search possible.
- Isolate identity stores. The system holding login credentials should not be reachable from general web applications. Limit network paths, require separate admin credentials, and alert on bulk reads or unusual queries against user directories.
- Treat "encrypted" passwords as exposed. If credential data is taken, force resets for the affected accounts, enforce MFA on portal and email access, and check stored passwords use a modern salted one-way hash rather than reversible encryption.
- Expect follow-up phishing. Names, departments and institutional email addresses enable targeted phishing. Warn affected staff and students, tighten email authentication controls, and watch for login attempts from unfamiliar locations.
- Audit contractors' data handling. The Osaka case shows data leaving through a subcontractor's cloud storage the university did not know about. Require vendors to disclose subcontractors, prove data has been deleted at the end of a contract, and state how long they keep logs.
Sources: Notice Regarding a Personal Information Breach Caused by Unauthoriz... | Chinese AI Tool Linked to Hacks in Japan | Leak of Personal Information by a Contractor － The University of Osaka | For customers WASABI SWITCH | Hackers’ infrastructure leak exposed a university data hunt Cybernews | Where do hackers break in from? Decoding the string of information... | Japan's JPCERT Details Data-Theft Methods, From App API Abuse to an... | 11 hours and 28 minutes. ◽️ Marek Gajewski