WASEDA UNIVERSITY
October 7, 2025
Apology Regarding Personal Information Disclosure
To individuals who arranged to have their English proficiency test scores (IELTS, TOEFL iBT) directly sent from the testing organization to Waseda University, there have been two incidents as detailed below that resulted in the disclosure of certain personal information.
We extend our deepest apologies to all affected individuals for the inconvenience and concern this has caused. We take this matter seriously and are committed to strengthening information management practices and educating our faculty and staff to prevent recurrence.
1. Details of the Incidents
1-1: Incident 1 (IELTS)
– Details:
A list of Test Report Form (TRF) numbers for applicants who arranged to have their IELTS scores directly sent to Waseda University was published on the School of Culture, Media and Society’s website. Using these TRF numbers, organizations* officially recognized by IELTS could access detailed personal information via the IELTS score verification portal, including name, date of birth, gender, email address, photo, Candidate ID Document Number, and test results.
* Educational institutions, companies, organizations, etc. that are officially registered with IELTS Headquarters as organizations that use IELTS as a standard for assessing English proficiency.
– Affected Individuals:
Applicants who arranged to have their IELTS (Academic) scores directly sent to the University for tests taken on or after October 1, 2023.
– Period of Exposure:
August 29, 2025 – September 9, 2025
– Number of Cases:
2,641
– Response:
The issue was identified on September 9, 2025, following an internal report. All related information was removed from the website on the same day, and access to the information was confirmed to be no longer possible.
1-2: Incident 2 (TOEFL iBT)
– Details:
A list of Appointment Numbers for JCulP applicants who arranged to have their TOEFL iBT scores directly sent to Waseda University was published on the School of Culture, Media and Society’s website. Organizations* officially recognized as TOEFL score users by ETS, the company that provides the test, could use these numbers along with other identifying information to access personal information via the TOEFL score verification portal, including name, photo, address, country of birth, email address, date of birth, gender, native language, type of ID document, last four digits of the ID document number, and test results. However, access to the personal information required not only the Appointment Number but also other information identifying the individual not published on the School’s website.
* Educational institutions, companies, organizations, etc. that receive TOEFL iBT scores and use them for admission decisions and selection processes.
– Affected Individuals:
Applicants who arranged to have their TOEFL iBT scores directly sent to Waseda University for JCulP “Japan Students” admission from the 2019 to 2026 academic years
– Period of Exposure:
August 27, 2018 – September 11, 2025
– Number of Cases:
777
– Response:
During the investigation of Incident 1 (IELTS), the issue related to TOEFL iBT Appointment Numbers was identified on September 11, 2025. All related information was removed from the website on the same day, and access was confirmed to be no longer possible.
2. Scope of Impact
For Incident 1, only organizations officially recognized by IELTS, and for Incident 2, those officially recognized as TOEFL score users by ETS, were able to access the personal information. As of now, there is no confirmed evidence that any third party including these organizations accessed or used the information.
3. Cause of the Incident
In this entrance examination, applicants were required to arrange to have their test scores sent directly from the testing organizations to the University. Since applicants were not notified by testing organizations when the scores reports arrived, some inquired with the School of Culture, Media and Society to confirm receipt. In response, and in order to provide a more convenient way for applicants to verify for themselves, the School published the TRF numbers and Appointment Numbers on its website. However, the fact that these numbers could also be used by other authorized organizations to access detailed personal information was not recognized.
4. Corrective Actions
All published TRF and Appointment Numbers have been removed from the School of Culture, Media and Society’s website and are no longer accessible.
5. Preventive Measures and Future Steps
These incidents were caused by inadequate risk awareness regarding the publication of identification numbers and how they can be used to access personal information on external websites.
To prevent recurrence, we will refrain from publishing information that can only be known by the individuals concerned unless absolutely necessary and only after thorough risk assessment. We will also enhance staff training to ensure proper understanding of external systems and tools and promote internal and external communication to strengthen information management.
Contact Information:
Waseda University Faculty of Letters, Arts and Sciences Office
Inquiry Form (dedicated to this matter):
Inquiry Form Regarding the English Score Card Information Security Incidents at Waseda University
