SHINDO2

Rikkyo University

Rikkyo Educational Corporation

Personal data6accounts

POSSIBLE LEAKMessages / email bodiesAccount takeover · Contained

Open in the live monitor ▶
Disclosed
Sep 8, 2026
Detected
Jul 16, 2026
Detection to disclosure
54 days
Leak
Leak possible
Type
Account takeover
Status
Contained
Security spend
Not checked yet
Compensation
Not announced

What leaked

Communications & contentStored email bodies
UnspecifiedPersonal information

How many

  • Google accounts of 4 students and 2 graduates 6 accounts

Who is affected

  • 4 students and 2 graduates

Cause

Accounts of students and graduates were taken over from overseas and used to send spam

Timeline

  1. Intrusion began
  2. Detected
  3. First disclosure

Response

  • Revoked credentials
  • Password reset
  • More monitoring
  • MFA

Suspended accounts, forced password changes, deleted graduate accounts and stepped up monitoring; considering passkeys

What you should do

  1. Check the company's notice to see if you're affected

Lessons for companies

  1. Report to the PPC: preliminary in 3–5 days, final in 30 (60 if malicious)
  2. Run red teaming and AI-assisted hardening, and publish how much you invest

Sources