SHINDO2

Chiba University

Personal data4accounts

POSSIBLE LEAKAccount takeover · Closed (final report)

Open in the live monitor ▶
Disclosed
Apr 17, 2026
Detected
Jan 30, 2026
Detection to disclosure
77 days
Leak
Leak possible
Type
Account takeover
Status
Closed (final report)
Security spend
Not checked yet
Compensation
Not announced

What leaked

UnspecifiedData including personal information in shared folders

How many

  • Accounts accessed without authorization 4 accounts
  • Spam emails sent 1,301 records
  • Accounts whose shared-folder data may have been viewed 3 accounts

Who is affected

  • Account users (including a student)
  • People whose data was in the shared folders

Cause

Unauthorized access by a third party to several Microsoft 365 accounts; the cause is not stated in the article

Timeline

  1. 630 emails sent from one student account in a short time were detected
  2. Announced

Response

  • MFA
  • Staff training
  • Phishing warning

Introduced multi-factor authentication for all Microsoft 365 users and will strengthen warnings and information-literacy training during fiscal 2026

What you should do

  1. You can be affected without ever using this service (parcel recipients etc.). Check any notice you receive
  2. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources