# Osaka Metropolitan University Suspected Ransomware Attack Halts Classes, Encrypts Backups and Exposes Data of 130,000+ Individuals

> Osaka Metropolitan University (OMU) suffered a suspected ransomware attack beginning in the early hours of 2 October 2026 that took down roughly 500 servers via its virtualization infrastructure and encrypted most recovery backups. Classes were cancelled through 8 October and personal data of at least 130,000 current and former students, faculty and associates may be exposed; data theft is unconfirmed.

- **Published:** 2026-10-06T00:00:00Z
- **Last reviewed:** 2026-10-10T08:06:56.920Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2980
- **ID:** TL-2026-2980
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In the early morning of 2 October 2026, Osaka Metropolitan University experienced a large-scale system failure that took down the campus network, internal email, portal sites, academic administration and educational support systems, financial accounting, payroll/HR, library services and the university websites across all five campuses (Morinosato, Sugimoto, Nakamozuokoshi, Abeno and Rinku). On 5 October the university held a press conference stating the outage was believed to be caused by a ransomware attack from outside the institution. Japanese reporting (Business+IT/SBbit, Security Measures Lab) states the intrusion hit the virtualization infrastructure underpinning the university's information systems, halting approximately 500 servers at once, and that most of the backup data needed for recovery was also encrypted, leaving recovery timelines uncertain. Signs that some data had been tampered with were also reported.

Affected personal data covers at least 130,000 current and former students, faculty, staff and other associated individuals, including legacy records inherited from Osaka City University (from 1995) and Osaka Prefecture University (from 2005), which merged to form OMU in 2022. Data elements cited across sources include names, addresses, email addresses, phone numbers, student ID photos and employee bank account details for salary transfers. The university stated it is still investigating whether any data was exfiltrated; no theft has been confirmed.

Not affected: entrance-exam application and enrollment procedures (hosted on external servers), the university hospital's electronic medical record system and the veterinary clinical center. Digital student ID services and course/assignment platforms were unavailable. The university reported the incident to the police, the Ministry of Education and Japan's Personal Information Protection Commission, engaged outside cybersecurity specialists, stood up an external temporary website for communications, cancelled all classes through 8 October with in-person classes planned to resume 9 October, and extended entrance-exam deadlines to 22 October.

No ransomware family or group, initial access vector, CVE, ransom demand or IOC has been publicly disclosed, and no leak-site claim was found during research. The incident was reported amid a string of Japanese corporate and institutional cyber incidents in 2026; no link between them has been established. Attribution and technical mapping below are limited to what sources evidence; Initial Access and Lateral Movement entries are inferred from the described virtualization-layer compromise and are low-confidence.

## MITRE ATT&CK

- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1565.001 Stored Data Manipulation
- T1078 Valid Accounts
- T1021 Remote Services
- T1486 Data Encrypted for Impact

## Sources

- [Osaka Metropolitan University cancels classes after suspected ransomware attack (The Record)](https://therecord.media/osaka-university-cancels-classes-ransomware)
- [Data on 130,000 students and teachers possibly exposed, Osaka university says (The Japan Times)](https://www.japantimes.co.jp/news/2026/10/06/japan/crime-legal/osaka-metro-university-data-leak/)
- [大阪公立大学、ランサムウェア攻撃でサーバー500台停止、13万人分の個人情報流出か (Business+IT)](https://www.sbbit.jp/article/cont1/187311)
- [大阪公立大学、ランサムウェア攻撃で約500台のサーバー停止―バックアップの多くも暗号化 (セキュリティ対策Lab)](https://rocket-boys.co.jp/security-measures-lab/osaka-metropolitan-university-ransomware-update-20261005/)
- [大阪公立大 大規模システム障害の原因は「ランサムウェアによるサイバー攻撃」か (KTV)](https://www.ktv.jp/news/articles/?id=30064)
- [Cyberattack on Osaka University Shuts Down 500 Servers (News on Japan)](https://newsonjapan.com/article/150954.php)
- [Osaka University Network Outage Adds to String of Cyberattacks in Japan (Seoul Economic Daily)](https://en.sedaily.com/international/2026/10/02/japan-cyberattacks-spread-as-osaka-university-network-goes)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2980