Security Knowledge
← Incident database

kwansei-external-sns-2026 · Disclosed 2026-09-01

関西学院大学: data exposure and authorization boundaries

Insufficient audience controls exposed student data publicly or to members of an external social network. 1,448 students and graduates were affected; exposed fields and periods vary by course.

Configuration / exposure

Outcome: Exposure / potential leak. Third-party theft unconfirmed.

Entry path and evidence

  • Reported fact

    Insufficient audience controls exposed student data publicly or to members of an external social network.

    [s1]§§1-7
  • Reported fact

    1,448 students and graduates were affected; exposed fields and periods vary by course.

    [s1]§§1-7

Timeline

  1. Disclosure date established by the reviewed notice. [s1]

Reported response

  • Reported fact

    Visibility was restricted, logs preserved and notifications sent; external-service approval and periodic review are planned.

    [s1]§§1-7

Evidence relevant to prevention

Operational controls to inspect

Inspect the disclosed configuration, authorization or operational issue. Verify applicability and retain evidence of behavior after remediation.

Editorial assessment; not a determination of liability. [s1]

Unknowns and AI involvement

AI involvementUnknown

The reviewed disclosures do not establish attacker use of AI.

The precise exposure start date and actual access by unintended viewers are unknown.

Sources

  1. [s1] 関西学院大学 · Primary source

    関西学院大学：事故に関する公表資料 ↗

    Reviewed 2026-10-09