NEC Says Hacked Contractor Led to Customer Breaches

The attack that knocked out hundreds of servers at Osaka Metropolitan University this month came in through a company the university never hired. According to NEC, which runs the university’s systems, attackers broke into one of its own contractors, took that firm’s legitimate login credentials, and used them to reach NEC’s customers.

In a notice dated 20 October, the Japanese IT group said a firm it outsources system development and maintenance work to was hit by a cyberattack in late September. Stolen credentials for legitimate accounts were then used to access customers’ systems from the contractor’s own terminals. Files on servers were encrypted, leaving various systems unusable. Separately, files leaked from a cloud storage service that NEC had created to share information with customers and with the contractor, and those files held customers’ personal data and system information.

TSN tracks attacks like this on its ransomware and cyber attacks hub.

NEC has not named the contractor or any customer. It says it has contacted the affected customers, whom it describes only as “multiple”, individually. It has also not said the attack was ransomware, and gives no detail on how the contractor was breached. According to Japan Cyber Watch, Nikkei and the Yomiuri Shimbun report that information on three customers leaked, two of them including personal data.

One customer lost about 500 servers in a night

Osaka Metropolitan University has identified itself as one of those customers. According to Japan Cyber Watch, about 500 servers on its virtualisation platform stopped early on 2 October, most of its backups were encrypted and classes were cancelled for a week. The university has described the attack on its own systems as ransomware, the site says, though NEC has not used that word for the incident as a whole.

On 21 October the university said that NEC, which maintains and operates its systems, had traced the outage to a cyberattack on a company NEC subcontracts, the Asahi Shimbun reported. Personal and system information connected to the university also leaked from NEC’s cloud storage, and the university is checking with NEC what was taken and how many records were affected. Japan Cyber Watch adds that the university treats this as separate from about 130,000 academic records on its own platform, whose possible leak it is still investigating.

As of 21 October, Japan Cyber Watch had found no listing for NEC or its customers on the ransomware leak sites tracked by ransomware.live.

Osaka University says NEC shared its data outside the contract

A second institution, Osaka University, has been openly critical of NEC. In a notice published on 21 October, which links to NEC’s statement, the university said NEC told it on 9 October that a third party had downloaded files containing its personal data on 26 September. NEC runs the university’s campus-wide educational computer system.

The university said its own inquiries found that a partner company it had never been told about was involved in the work, and that NEC had shared files containing personal data on cloud storage with that company without any basis in its contract with the university. NEC had also kept files it should have deleted once the work was finished. The data of 77,851 people was exposed, mostly graduates but also more than 15,000 students and about 3,800 staff, including names and university email addresses.

NEC’s investigation found no trace of related unauthorised access to the university’s own system, Osaka University said, and no misuse of the data has been confirmed so far. Even so, it called the undisclosed subcontracting and NEC’s handling of the files a “serious problem”, and said it would press NEC for a full account and measures to prevent a repeat. The Asahi reported that Osaka University’s data was among the files that leaked from the NEC cloud storage shared with the subcontractor.

NEC, for its part, says it now lends NEC-managed computers to the contractor and will tighten how it manages contractors and personal data. Osaka University’s complaint is more basic: a company it had never been told about had been given files on 77,851 of its people at all.