Threat reportRansomwareTL-2026-2980
Osaka Metropolitan University Suspected Ransomware Attack Halts Classes, Encrypts Backups and Exposes Data of 130,000+ Individuals
Osaka Metropolitan University Suspected Ransomware Attack (TL-2026-2980) is a high-severity ransomware operation, first published 2026-10-06 and last reviewed 2026-10-10. It has no confirmed attribution, affects Osaka Metropolitan University Campus IT infrastructure (virtualization, maps to 6 MITRE ATT&CK techniques (T1021, T1078, T1486), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 6MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-2980
- Threat ID
- TL-2026-2980
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- education, higher education, research
- Target regions
- japan, East Asia
- Detection rules
- 9
- Indicators of compromise
- 11
- Updates
- 2026-10-10 · revalidated 1× · latest source
How Osaka Metropolitan University Suspected Ransomware Attack works
Osaka Metropolitan University (OMU) suffered a suspected ransomware attack beginning in the early hours of 2 October 2026 that took down roughly 500 servers via its virtualization infrastructure and encrypted most recovery backups. Classes were cancelled through 8 October and personal data of at least 130,000 current and former students, faculty and associates may be exposed; data theft is unconfirmed.
In the early morning of 2 October 2026, Osaka Metropolitan University experienced a large-scale system failure that took down the campus network, internal email, portal sites, academic administration and educational support systems, financial accounting, payroll/HR, library services and the university websites across all five campuses (Morinosato, Sugimoto, Nakamozuokoshi, Abeno and Rinku). On 5 October the university held a press conference stating the outage was believed to be caused by a ransomware attack from outside the institution. Japanese reporting (Business+IT/SBbit, Security Measures Lab) states the intrusion hit the virtualization infrastructure underpinning the university's information systems, halting approximately 500 servers at once, and that most of the backup data needed for recovery was also encrypted, leaving recovery timelines uncertain. Signs that some data had been tampered with were also reported.
Affected personal data covers at least 130,000 current and former students, faculty, staff and other associated individuals, including legacy records inherited from Osaka City University (from 1995) and Osaka Prefecture University (from 2005), which merged to form OMU in 2022. Data elements cited across sources include names, addresses, email addresses, phone numbers, student ID photos and employee bank account details for salary transfers. The university stated it is still investigating whether any data was exfiltrated; no theft has been confirmed.
Not affected: entrance-exam application and enrollment procedures (hosted on external servers), the university hospital's electronic medical record system and the veterinary clinical center. Digital student ID services and course/assignment platforms were unavailable. The university reported the incident to the police, the Ministry of Education and Japan's Personal Information Protection Commission, engaged outside cybersecurity specialists, stood up an external temporary website for communications, cancelled all classes through 8 October with in-person classes planned to resume 9 October, and extended entrance-exam deadlines to 22 October.
No ransomware family or group, initial access vector, CVE, ransom demand or IOC has been publicly disclosed, and no leak-site claim was found during research. The incident was reported amid a string of Japanese corporate and institutional cyber incidents in 2026; no link between them has been established. Attribution and technical mapping below are limited to what sources evidence; Initial Access and Lateral Movement entries are inferred from the described virtualization-layer compromise and are low-confidence.
MITRE ATT&CK techniques used in TL-2026-2980
Lateral Movement
Initial Access
Impact
T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1565.001 Stored Data Manipulation
Affected products and versions in Osaka Metropolitan University Suspected Ransomware Attack
- Osaka Metropolitan University — Campus IT infrastructure (virtualization platform, network, email, portal, academic, finance, payroll/HR, library, websites)
Remediation for Osaka Metropolitan University Suspected Ransomware Attack
Immediate actions
- Isolate hypervisor management networks and rotate all virtualization-platform, domain and service-account credentials
- Preserve forensic images of affected hypervisors and backup repositories before rebuild
- Monitor for leak-site posting or extortion contact referencing the institution
- Notify affected individuals and regulators per local personal-data law
Workarounds
- Use external temporary sites and alternative channels for communications and online classes during recovery
Longer-term hardening
- Keep immutable, offline or logically air-gapped backups outside the virtualization management domain
- Segment hypervisor/management planes and enforce MFA on all administrative access
- Maintain tested restore procedures for the virtualization layer and identity systems
- Host critical external-facing workflows (e.g. admissions) off the core campus infrastructure, as OMU's entrance-exam systems were
Timeline of Osaka Metropolitan University Suspected Ransomware Attack
- Osaka City University and Osaka Prefecture University merge to form Osaka Metropolitan University; legacy records from both (1995 and 2005 onward) are later implicated in the exposure.
- Approximately 500 servers halt after intrusion into the virtualization infrastructure; most backup data needed for recovery is also encrypted.
- Early-morning large-scale system failure takes down the campus network, email, portal, academic systems and websites across all five campuses; classes cancelled for the day.
- University notifies police, the Ministry of Education and Japan's Personal Information Protection Commission and engages outside cybersecurity specialists.
- University press conference states the outage is believed caused by a ransomware attack from outside; at least 130,000 individuals' data possibly exposed, theft under investigation.
- The Record and The Japan Times report the incident; no ransomware group, ransom demand or entry vector disclosed.
- OMU publishes its fourth update: temporary Moodle (enrollment data as of 2026-09-30), temporary academic affairs system and digital service desk in place; internal OMU email restored.
- Final day of all-faculty class cancellations while restoration continues.
- In-person classes resume at all campuses; the university hospital and veterinary clinical center were reported unaffected throughout.
- In-person classes planned to resume; online classes to restart depending on system recovery.
- Planned approximate date for staged restoration of external email sending and receiving.
- Entrance-exam procedure deadline extended to 22 October due to the disruption.
Update history for TL-2026-2980
- 2026-10-10 — Osaka Metropolitan University Ransomware Attack Disrupts University Systems; ~130,000 Records at Risk: What changed No field escalation. Recovery has progressed: internal email restored 2026-10-08, in-person classes resumed 2026-10-09, external email planned around 2026-10-13. The newer report lists exploitability NONE, which would be a down
Sources cited for Osaka Metropolitan University Suspected Ransomware Attack
- Osaka Metropolitan University cancels classes after suspected ransomware attack (The Record)
- Data on 130,000 students and teachers possibly exposed, Osaka university says (The Japan Times)
- 大阪公立大学、ランサムウェア攻撃でサーバー500台停止、13万人分の個人情報流出か (Business+IT)
- 大阪公立大学、ランサムウェア攻撃で約500台のサーバー停止―バックアップの多くも暗号化 (セキュリティ対策Lab)
- 大阪公立大 大規模システム障害の原因は「ランサムウェアによるサイバー攻撃」か (KTV)
- Cyberattack on Osaka University Shuts Down 500 Servers (News on Japan)
- Osaka University Network Outage Adds to String of Cyberattacks in Japan (Seoul Economic Daily)
Detection coverage for TL-2026-2980
As of 2026-10-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2980 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.