Osaka Metropolitan University cancelled classes and shut down a large share of its IT after a suspected ransomware attack that began late last week. About 500 servers stopped. Japanese media report that names, addresses and email for as many as 130,000 current and former students and staff may have been exposed. In-person classes are planned to resume Friday; online classes wait on recovery. The hospital’s electronic medical records stayed up.
Get the CyberExperts Daily Brief: the day's top security news in 5 minutes. Free.
Nearly 500 servers down. Classes cancelled through Thursday. Backups were hit too.
Email, payroll, HR and library systems offline
OMU said on Tuesday, October 6, that the outage took down its internal network, email, and systems used for academic administration, educational support, financial accounting, payroll, human resources and library services, plus university websites. Japanese media, citing a Monday press conference, reported roughly 500 servers offline and potential exposure of data tied to about 130,000 people, including records from Osaka Prefecture University and Osaka City University, which merged into OMU in 2022.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The university believes ransomware caused the disruption, is working with outside specialists, and has not identified the attackers or confirmed a ransom demand. It has not confirmed that personal data was actually stolen and said Tuesday it was still investigating leakage. The incident was reported to Japan’s data protection authority and other agencies. Entrance-exam and enrollment systems hosted externally stayed available. The university hospital’s EMR and the veterinary clinical center kept operating.
When the shared layer fails, hundreds of servers go with it
An outage this size looks like a hit on the virtualization layer. When the hypervisor or the shared recovery path goes down, hundreds of guest systems go with it, and backups on that same path may not be there to restore from. Classes cancelled through at least Thursday, with a return planned for Friday, October 9, are the visible cost. For other campuses and mid-size companies the lesson is practical. Keep the recovery systems on their own network segment, test restores offline, and run identity and EMR-class systems on a different failure domain.
Test a restore with the cluster and backups both gone
- Ask your infra owner one question this week: if the virtualization cluster and its backup adapters were encrypted together, what still boots from an offline copy?
- Confirm backup repositories are immutable or air-gapped from the production identity domain, and that a restore has been tested in the last 90 days.
- Map which student / HR / payroll systems share the same hypervisor, storage fabric or backup job as everything else.
- For universities and research orgs: treat merged-legacy identity stores (old campus IDs still in the directory) as in-scope for breach notification planning.
Forward this
Osaka Metropolitan University just lost roughly 500 servers to suspected ransomware and cancelled classes into Thursday, with possible exposure for about 130,000 people. Please put a 30-minute restore drill on the calendar: can we recover critical systems if the virtualization cluster and its backup path fail together? That answer tells us more than our “3-2-1” policy on paper.
Details
- Org: Osaka Metropolitan University (OMU), Japan.
- Impact: Internal network, email, academic / admin / HR / payroll / library systems and websites unavailable; ~500 servers reported offline.
- Data: Up to ~130,000 current/former students, faculty and affiliates possibly exposed (names, addresses, emails); theft not confirmed as of October 6.
- Classes: Cancelled through at least Thursday; in-person resume planned Friday, October 9, 2026. Online classes depend on recovery.
- Still up: Externally hosted entrance-exam / enrollment systems; university hospital EMR; veterinary clinical center.
- Attribution: Not identified. Ransom demand not confirmed publicly.
Hunt / verify
- No CVE is involved here. Use the incident as a tabletop prompt: list every system that shares backup credentials or hypervisor admin with production.
- Verify immutability flags / object-lock on backup buckets and that delete permissions require a separate break-glass role.
- Confirm notification playbooks cover “possible exposure, theft not confirmed” language. That is where OMU stands right now.
OMU (Osaka) suspected ransomware: ~500 servers down, classes cancelled through Thu, ~130k people possibly exposed (theft not confirmed). Hospital EMR stayed up. Action for us: prove offline restore if virt cluster + backup path fail together; check backup immutability this week.
Sources
- https://therecord.media/osaka-university-cancels-classes-ransomware
- https://www.japantimes.co.jp/news/2026/10/06/japan/crime-legal/osaka-metro-university-data-leak/
- https://jen.jiji.com/jc/eng?g=eco&k=2026100600316
- https://e.omu.ac.jp/announce/1.html
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
