Osaka Metropolitan University cancelled classes and shut down a large share of its IT after a suspected ransomware attack that began late last week. About 500 servers stopped. Names, addresses and email for as many as 130,000 current and former students and staff may have been exposed. In-person classes are planned to resume Friday; online classes wait on recovery. The hospital’s electronic medical records stayed up.
Nearly 500 servers down. Classes cancelled through Thursday. Backups were in the blast radius too.
What happened
OMU said on Tuesday, October 6, that the outage took down its internal network, email, and systems used for academic administration, educational support, financial accounting, payroll, human resources and library services, plus university websites. Japanese media, citing a Monday press conference, reported roughly 500 servers offline and potential exposure of data tied to about 130,000 people, including records from Osaka Prefecture University and Osaka City University, which merged into OMU in 2022.
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The university believes ransomware caused the disruption, is working with outside specialists, and has not identified the attackers or confirmed a ransom demand. It has not confirmed that personal data was actually stolen and said Tuesday it was still investigating leakage. The incident was reported to Japan’s data protection authority and other agencies. Entrance-exam and enrollment systems hosted externally stayed available. The university hospital’s EMR and the veterinary clinical center kept operating.
Why it matters
This is the operational shape of a virtualization-layer hit: when the hypervisor or the shared recovery path goes, hundreds of guests go with it, and “we have backups” stops meaning what the slide deck said. Class cancellations through at least Thursday (resume planned Friday, October 9) are the visible cost. The quieter lesson for every campus and mid-size enterprise: segment the recovery plane, prove restores offline, and keep identity and EMR-class systems on a different failure domain.
What to do first
- Ask your infra owner one question this week: if the virtualization cluster and its backup adapters were encrypted together, what still boots from an offline copy?
- Confirm backup repositories are immutable or air-gapped from the production identity domain, and that a restore has been tested in the last 90 days.
- Map which student / HR / payroll systems share the same hypervisor, storage fabric or backup job as everything else.
- For universities and research orgs: treat merged-legacy identity stores (old campus IDs still in the directory) as in-scope for breach notification planning.
Forward this
Osaka Metropolitan University just lost roughly 500 servers to suspected ransomware and cancelled classes into Thursday, with possible exposure for about 130,000 people. Please put a 30-minute restore drill on the calendar: can we recover critical systems if the virtualization cluster and its backup path fail together? That answer matters more than another slide about “3-2-1.”
Details
- Org: Osaka Metropolitan University (OMU), Japan.
- Impact: Internal network, email, academic / admin / HR / payroll / library systems and websites unavailable; ~500 servers reported offline.
- Data: Up to ~130,000 current/former students, faculty and affiliates possibly exposed (names, addresses, emails); theft not confirmed as of October 6.
- Classes: Cancelled through at least Thursday; in-person resume planned Friday, October 9, 2026. Online classes depend on recovery.
- Still up: Externally hosted entrance-exam / enrollment systems; university hospital EMR; veterinary clinical center.
- Attribution: Not identified. Ransom demand not confirmed publicly.
Hunt / verify
- This is an external incident, not a CVE. Use it as a tabletop prompt: list every system that shares backup credentials or hypervisor admin with production.
- Verify immutability flags / object-lock on backup buckets and that delete permissions require a separate break-glass role.
- Confirm notification playbooks cover “possible exposure, theft not confirmed” language — that is the posture OMU is in right now.
OMU (Osaka) suspected ransomware: ~500 servers down, classes cancelled through Thu, ~130k people possibly exposed (theft not confirmed). Hospital EMR stayed up. Action for us: prove offline restore if virt cluster + backup path fail together; check backup immutability this week.
Sources
- https://therecord.media/osaka-university-cancels-classes-ransomware
- https://www.japantimes.co.jp/news/2026/10/06/japan/crime-legal/osaka-metro-university-data-leak/
- https://jen.jiji.com/jc/eng?g=eco&k=2026100600316
- https://e.omu.ac.jp/announce/1.html
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
