Osaka Metropolitan University Confirms Ransomware Attack as 500 Servers Go Dark and Backups Are Encrypted

Osaka Metropolitan University confirmed Monday that a large-scale failure of its core information systems was a ransomware cyberattack, after days of disruption that began in the early hours of Friday, 2 October 2026. About 500 servers stopped simultaneously, most backup data was encrypted and rendered unusable, and the university says it has found signs that some data was tampered with. At least 130,000 records of personal information were held on the affected systems, and the university has not ruled out a leak.

Osaka Metropolitan University Confirms Ransomware Attack as 500 Servers Go Dark and Backups Are Encrypted

Osaka, Japan — Osaka Metropolitan University said Monday that a sweeping failure of its core information systems was a ransomware cyberattack from outside the institution, confirming what had been under investigation since the disruption began in the early hours of Friday, 2 October 2026. The university's president apologised to students, applicants, graduates, parents, research partners and local residents, and said the university is investigating whether personal data was leaked. Classes across all faculties are cancelled through 8 October, with in-person teaching set to resume on Friday, 9 October.

The Press Conference That Confirmed It

Osaka Metropolitan University confirmed at a press conference on Monday, 5 October 2026, that the large-scale failure of its core information systems was a ransomware cyberattack. The briefing was held at 4pm at the public university corporation in Joto-ku, Osaka City, according to MBS News. University president Hiroyuki Sakuragi apologised directly to those affected, naming students, applicants, graduates, parents, joint research institutions, business partners and local residents. On 2 October, the cause was still under investigation; by 5 October, the university said it had judged the cause to be a ransomware cyberattack originating from outside the institution. The confirmation came three days after systems first went down, and it left several central questions unanswered — including whether a ransom was demanded and whether any data has actually left the university's control. The university says it is investigating the possibility of a leak, and has not confirmed one.

What Hackers Reached First

The attackers entered the virtualization platform that runs many of the university's systems, according to the university's account of the incident. That layer sits beneath individual machines, hosting many systems as virtual machines on shared infrastructure. Japan Cyber Watch, analysing the case, noted that many major ransomware groups have encryptors built specifically for hypervisors, meaning a single foothold in the virtualization layer can stop hundreds of servers at once. Because the compromise occurred at that level rather than on individual PCs or a single server, the impact landed on teaching, research and administration simultaneously. The university has not said how the attackers obtained their initial access, nor how long they were present before the disruption began in the early hours of 2 October. No ransomware group or strain has been publicly identified in connection with the attack.

Half a Thousand Servers, One Foothold

About 500 servers stopped simultaneously, the university said. Japan Cyber Watch described the mechanism in blunt terms: when many systems run as virtual machines on shared infrastructure, control of that layer is control of all of them, and of any backups stored or managed within reach. That is how one intrusion becomes 500 stopped servers and backups that cannot be used, the outlet said. The figure describes the situation at the onset of the disruption; the university has not stated how many servers remain offline. The campus network, email, the student portal and academic systems are down across all campuses. Internal systems used for classes and assignment submissions are unavailable. The main website, www.omu.ac.jp, is offline, and the university is publishing updates through its entrance page and a temporary notice site.

The Backups That Cannot Be Used

Most of the backup data was also encrypted and is unusable, according to the university. The loss of usable backups is what turns a serious outage into a prolonged one, and it is consistent with an intrusion that reached the virtualization layer where backups were stored or managed. The university also confirmed signs that some data had been tampered with or altered. It has given no estimated date for full system recovery. Japan Cyber Watch cautioned that the temporary notice site uses a domain outside omu.ac.jp, and that students and others should reach it through the university's entrance page, e.omu.ac.jp, rather than through links in emails or messages, since scammers often imitate emergency notices. The university has not disclosed whether the attackers issued a ransom demand.

At Least 130,000 Records

At least 130,000 records of personal information were held on the affected systems, the university said. Those records cover current students, graduates, faculty and staff. The data types reported include names, addresses, email addresses and student ID photographs, with mobile phone numbers also reported. The records reach back to students of Osaka City University from 1995 and Osaka Prefecture University from 2005 — the two institutions that merged to form Osaka Metropolitan University in 2022. The university says it is investigating whether any data was leaked; that is not confirmed. It reported the incident to Osaka Prefectural Police and to MEXT, the Ministry of Education, Culture, Sports, Science and Technology. On 5 October it also notified the government's Personal Information Protection Commission, and says it will investigate together with the relevant bodies.

Five Campuses, No Timetable

The disruption spans all five campuses: Morinomiya, Sugimoto, Nakamozu, Abeno and Rinku. All classes at all faculties are cancelled through 8 October. Classes were initially cancelled for the whole of 2 October and then extended. The university plans to resume in-person classes on Friday, 9 October, as scheduled. There is no estimated date for full system recovery. Application registration for the comprehensive selection process, formerly the AO entrance exam, and part of the enrolment procedure has had its deadline extended to 22 October. The university hospital and the veterinary clinical centre have their homepages unavailable, but electronic medical records are unaffected and clinical services are continuing as normal, the university said.

A Student Watching a Spinning Wheel

A third-year student in the Faculty of Engineering told Yomiuri TV that the timetable and assignment page on their phone shows a communication error, and said their digital student ID also does not work. The student hopes recovery comes soon so campus life can resume. The account captures what the outage looks like from the outside: not a single dramatic failure but a set of everyday tools that simply stop answering. The student portal, email, the campus network and the systems used for classes and assignment submissions are all unavailable. The main university website remains offline. Updates are being routed through the entrance page and the temporary notice site, which the university and outside analysts have urged users to reach only through the official entrance page.

The Wider Pattern in Japan

The university's outage is the latest in a run of significant cyber incidents in Japan. Government Solution Service, a system commonly used by Japanese government ministries and agencies, was repeatedly accessed by an external third party from around late May 2026. The Digital Agency discovered files were accessed in late June and found the intrusion on 9 July; a vulnerability in a VPN product was exploited via a maintenance-and-operations employee's account. About 240,000 people were affected and more than 246,000 records were compromised — about 236,000 names, about 231,000 email addresses, about 94,000 phone numbers and about 1,000 addresses. The Digital Agency disclosed the breach in September 2026. Separately, LY Corp reported a mobile game service leak affecting roughly 7.1 million users.

What Has Not Been Answered

Several central questions remain open. The university has not disclosed whether the attackers issued a ransom demand, and no ransom amount has been confirmed. No ransomware group or strain has been publicly identified. The university says it is investigating whether any data was leaked, and has not confirmed a leak. It has given no estimated date for full system recovery. It has not stated how many servers remain offline beyond the roughly 500 that stopped at the onset. It has not said how the attackers obtained their initial access, nor how long they were inside the network before the disruption began in the early hours of 2 October. The university says it will investigate together with the relevant bodies, including Osaka Prefectural Police, MEXT and the Personal Information Protection Commission.

Where This Leaves the University

Osaka Metropolitan University was formed in 2022 by merging Osaka City University and Osaka Prefecture University. With an undergraduate intake of about 2,850, when it opened it was the third-largest national or public university in Japan, after Osaka University and the University of Tokyo, according to Nikkei. The university now faces a recovery with no published timeline, a student body locked out of basic academic tools, and an open question over at least 130,000 records of personal information. In-person classes are set to resume on 9 October, even as the systems that support them remain down. President Sakuragi's apology, delivered at the 5 October briefing, acknowledged the breadth of those affected: students, applicants, graduates, parents, joint research institutions, business partners and the local community.

By Jessica Ali, Staff Writer

This article was produced with AI-assisted research and editorial support. Sources: Japan Cyber Watch, News On Japan, Yomiuri TV, MBS News, Shinmai (Kyoto Shimbun), Chugoku Shimbun, Seoul Economic Daily, SecurityWeek, The Japan Times, Digital Agency of Japan.