From our other sites
The story
Osaka University announced that personal information — including the names and email addresses of roughly 78,000 students and graduates — had leaked outside the university. The leak occurred through a server used by NEC, which handles the university’s system operations, to share information with a partner company; NEC says the cause was a cyberattack on that partner company. However, according to the university, information-sharing between NEC and the partner company was never part of the contract in the first place — NEC had been doing this without the university’s authorization. On 5ch, commenters mostly criticized the lax oversight of the subcontracted vendor, and many pointed out that other universities and public institutions with similar outsourcing structures could be at risk too.
Osaka University announced that personal information belonging to about 78,000 people — including students’ names and email addresses — had been leaked.
According to Osaka University, personal information such as the names and email addresses of about 78,000 students and graduates leaked from a server that NEC, which is contracted to manage the university’s systems, uses to share information with a partner company.
NEC attributes the cause of the leak to a cyberattack on the partner company, but according to the university, information-sharing between NEC and the partner company was not part of the contract, and NEC had been sharing the personal information without the university’s authorization.
Source: newsdig.tbs.co.jp / Original article here
What people said
Wasn't that the company that used to sell game consoles at Comiket, the fan convention for amateurs?
I finally took the plunge and bought a "PC Engine SuperGrafx" back in the day
And only 4 games were ever made specifically for it
If the flagship school is like this, every national/public university in the Kansai region is probably in trouble
but knowing how these things go, they'll probably just let it slide and skip the lawsuit, right?
There's no such thing as "filing" or "not filing" charges in a civil case, that's a criminal law term
No real innovation to speak of, just cutting corners everywhere — it's genuinely bad.
As long as companies like this keep dominating, Japanese industry is never going to recover.
Data management work isn't really the kind of job where "innovation" even comes into it, is it?
Though this time they didn't even manage basic reliability, which is the real punchline
That's a violation of the Personal Information Protection Act, you know
So true
And on top of that, the maintenance work at these partner companies is probably being done by non-regular (temp/contract) staff. This is exactly why Japan is declining.
NEC doesn't have any real technical skill to begin with
All they've got is connections and a brand name
And it's not just NEC — this is why "JTCs" (old-school Japanese megacorps) can't get anything done without throwing it at subcontractors
Was the prime contractor actually any more technically competent, though?
Also, wasn't this more of an old-fashioned analog leak than an actual "cyberattack"?
The Personal Information Protection Act is riddled with loopholes built for list brokers (companies that trade in personal data lists)
A one-person outfit sure isn't going to have a competent IT administrator on staff, so it's just a pile of risk
Well, the more talented an engineer is, the more likely they are to go independent and start their own company, so…
There must be other clients who outsourced to NEC too, and probably other unauthorized information-sharing going on
Just hurry up and disclose it all already, NEC
No way it's limited to just the public university and Osaka University
It's not really a flagship company anymore, is it
Normally Osaka University should be Japan's #2, shouldn't it?
Going by population it'd be Yokohama National University
Hurry up and repeal that revision already
Yeah, there was a recent revision saying that for the sake of AI development, all personal information (name, address, age, medical history, etc.) can be linked together and handed over
With the government taking that stance, personal information protection is basically meaningless now
Just say "it's for AI development" and you can scoop up as much personal data as you want
There's a university like that?
I bet even most Japanese people have never heard of it
If we're counting famous celebrity alumni, Yokohama National University wins
B'z's Inaba, SUITS (the guitarist)…
Every home appliance maker was trying to become a full-line general electronics company back then. That's just how the era was.
The good old days of Japan's high economic growth
Decline it, for the sake of your alma mater
Your information's probably not even on file anymore
Should've stopped at the PC Engine CD-ROM²
I bought the Super 32X, and I should've stopped at the Mega CD too
I never did end up buying the CD-ROM². Hooking one up to the "PC Engine SuperGrafx" required an adapter.
Background and key points of this discussion
It’s not unusual in Japan’s domestic IT industry for universities and government agencies to outsource system operations to a major IT vendor, which then further subcontracts the actual maintenance and operations work to partner companies, creating a multi-layered subcontracting structure. What drew criticism here wasn’t the leak itself so much as the contract violation and management failure: NEC handed personal information to a partner company not specified in its contract, without the university’s permission. The Personal Information Protection Act requires reporting when a leak occurs, but whether a client can always track and supervise what information a contractor shares when it re-subcontracts the work is a separate matter — and the same structure could easily exist in other universities’ or local governments’ systems. Opinions in the thread split over where the responsibility truly lies: with NEC’s poor management for actually handing over the data, or with the university for its lax oversight and contract design with its vendor.
※This article is compiled as an excerpt/summary of the 5ch (News Speed+) thread “Osaka University leaks personal information of approx. 78,000 people… Subcontractor “NEC” shared information with a partner company without the university’s permission → blamed on cyberattack damage” with excerpts and summarization.
Leave a Reply