Cyber Incident Victim: Hokkaido University
Date:
Dec 2015
Location:
Japan
Summary
Hokkaido University experienced unauthorized access to a career placement server potentially compromising personal data of approximately 112,600 students and graduates—including names, addresses, and birth dates—along with job-hunting information for 1,600 companies. The breach was detected when the server transmitted spam externally, prompting network isolation after unusual communications with unspecified domestic and foreign servers were identified. While only 12 authorized personnel should have accessed the system, investigators suspect external parties obtained credentials to infiltrate the server. University officials apologized for the incident and established an investigative panel to verify data exposure and assess institutional data management practices while pledging preventive measures.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 27, 2015, Hokkaido University detected suspicious activity when a server at its career placement service center began sending spam messages to external recipients. This prompted an investigation, leading to the discovery on January 4, 2016, that the server had been communicating extensively with unspecified external servers both within Japan and internationally. The university immediately disconnected the compromised server from its network to contain the breach. Forensic analysis revealed unauthorized access to the server, which stored sensitive personal information of approximately 112,600 current and former students, including names, addresses, and birth dates. The server also contained job-hunting-related data for about 1,600 companies that recruited through the university. Only 12 authorized personnel at the career center should have had access to this internal system, suggesting credential compromise enabled the intrusion.
The university publicly disclosed the incident on January 13, 2016, with Vice President Kazunori Yasuda formally apologizing for the potential data exposure during a press conference. While investigators confirmed unauthorized access occurred, they could not definitively confirm whether the attackers successfully exfiltrated the personal data. A dedicated investigative panel was established on January 8 to assess both the likelihood of data leakage and the adequacy of the university's existing data management protocols. Yasuda pledged organizational reforms to strengthen data governance and prevent future breaches, emphasizing enhanced security measures for sensitive information systems. The incident disrupted career support operations and exposed students and corporate partners to potential identity theft or phishing risks due to the compromised personal identifiers.