NEC contractor cyberattack: customer system encryption via stolen credentials and information leakage including Osaka University
nec-contractor-breach-2026 · Disclosed 2026-10-20
NEC's system development/maintenance contractor was cyberattacked in late September, with stolen legitimate account credentials used for unauthorized access to customer systems. Server files were encrypted causing outages, and personal and system-related information leaked from cloud storage shared among NEC, customers, and contractors. Personal information leakage was confirmed for 2 of 3 affected customers, with approximately 77,851 people's information at Osaka University.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
The contractor was cyberattacked in late September, with stolen legitimate account credentials being abused. Unauthorized access using legitimate accounts occurred from contractor terminals.
[s1]9月下旬にサイバー攻撃を受け、窃取された正規アカウントの認証情報が悪用 - Reported fact
Customer systems were accessed without authorization, server files were encrypted, and systems became unavailable. Files in cloud storage shared among NEC, customers, and contractors leaked, containing customer personal information and system-related data.
- Reported fact
At Osaka University, personal information of 77,851 people leaked, including 15,035 current students, 59,014 graduates, and 3,802 faculty/staff. NEC had shared files containing personal information on cloud storage to collaborate with an unreported partner company.
[s3]計7万7,851人分 / 大学に報告していない協力会社
Timeline
Reported response
- Reported fact
After discovery, NEC is advancing necessary measures including lending NEC-managed terminals to contractors. Individual contact has been made to multiple affected customers, focusing on response and early clarification of full scope.
[s1]委託先に当社管理の端末を貸与
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Operational controls to inspect
Contractor terminal management and credential protection were inadequate. Management practices that allowed sharing personal information with partner companies without customer notification were also problematic. Related rules inspect contractor management, credential protection, and information sharing approval processes.
Editorial assessment; not a determination of liability. [s1][s3]
Unknowns and AI involvement
The reviewed primary sources do not establish attacker use of AI.
Names of 3 customer companies (excluding Osaka University), contractor name, specific intrusion path, CVEs used, and full scope of leaked information remain unresolved.
Sources
[s1] NEC · Primary source
委託先への不正アクセスに起因するお客さまのシステム障害、情報漏えいに関するお詫び ↗Published 2026-10-20 · Reviewed 2026-11-02
[s2] ITmedia NEWS · Secondary
NECの委託先にサイバー攻撃 正規アカウント悪用し顧客のサーバ暗号化、個人情報の漏えいも ↗Published 2026-10-20 · Reviewed 2026-11-02
[s3] ITmedia NEWS · Secondary
大阪大、学生など7.8万人の情報漏えい NECが無断で協力会社とデータ共有 ↗Published 2026-10-22 · Reviewed 2026-11-02