November 9, 2026
Waseda University

Waseda University has confirmed that a third party had gained unauthorized access to an IT system used to manage personal information.

Our investigation has determined that approximately 3,400 user records managed in the system were obtained by the unauthorized third party.

This incident came to light during a review of the security status of the University’s IT systems conducted in response to a PHP vulnerability. During that review, the University identified evidence of unauthorized access that had occurred on August 31, 2026. The University subsequently expanded the scope of its investigation and confirmed both the intrusion into the IT system used to manage personal information and the unauthorized acquisition of certain information.

We sincerely apologize for the considerable concern and inconvenience this incident has caused to our faculty and staff, students, alumni, and other members of the Waseda University community.

1. Details of the Personal Information Breach

The IT system in which the intrusion was confirmed manages user information used to log in to MyWaseda, the University portal that provides access to email and other services. The information managed in the system includes faculty and staff ID numbers, names, Waseda email addresses, department names, affiliation categories, and password information stored in encrypted form.

Our investigation confirmed that an unauthorized third party wrongfully obtained a total of 3,342 records, comprising the information described in items (1) and (2) below.

(1) Individual information relating to current and former faculty and staff, students, alumni, and others: 81 records in total

The following sets of information were obtained individually:

• Name and affiliation category: 38 records
• Name, affiliation category, and Waseda email address: 23 records
• Name and password information stored in encrypted form: 20 records

(2) User information relating to staff members and others: 3,261 records

The following six data items were obtained together as a single set of user information:

• Faculty or staff ID number
• Name
• Waseda email address
• Department name
• Affiliation category
• Password information stored in encrypted form

The figures above represent the total number of records, not the number of unique individuals. Since a single user may have multiple email addresses, the actual number of individuals concerned does not necessarily correspond to the figures shown above. Also, the password information was not stored in the same form as the passwords entered by users; it was stored in encrypted form.

At this time, we have not confirmed that any information other than that described in items (1) and (2) above was obtained by an unauthorized third party. However, because the possibility that other information was obtained cannot be ruled out, we are continuing our detailed investigation.

*To date, no impact from this unauthorized access has been confirmed with respect to information relating to applicants for admission or participants in Waseda University’s Open College courses.

2. Measures Taken by the University and Actions Requested of Those Concerned

Following the discovery of the unauthorized access, the University has prioritized preventing further harm and protecting MyWaseda users. Measures taken include suspending the relevant systems, restricting external communications and access, changing system administrator passwords, and restricting the use of related services.

The University is also conducting a detailed investigation into the route of intrusion, whether any additional information was obtained, and the scope of the impact, in cooperation with an external cybersecurity specialist. We have reported the incident to and consulted with the relevant authorities.

Students, faculty, and staff are being individually informed of the necessary actions, including changing the passwords associated with their Waseda email addresses.

To prevent further harm, the University has temporarily suspended MyWaseda and other services that use Waseda IDs for alumni, including Waseda email and certificate issuance services, until their security has been confirmed. The timing of service restoration and any further actions will be announced separately.

Fraudulent emails, SMS messages, or other communications impersonating the University or related parties may be sent in connection with this incident. Please exercise particular caution and do not access links, open attachments, or enter IDs, passwords, or other information in response to unsolicited or unfamiliar communications.

3. Ongoing Investigation and Further Updates

The University will continue its detailed investigation. If new information requiring public disclosure becomes available concerning the individuals or information affected, the scope or cause of the breach, or its impact, we will promptly provide an update through the University website and other appropriate channels without waiting for the investigation to be completed. Where necessary, we may also contact the individuals concerned directly.

Based on the results of the investigation, the University will assess the cause and impact of the incident and implement the necessary security measures. We will also review our incident response framework, including monitoring and detection, initial response procedures, and information-sharing processes, and will take measures to prevent a recurrence.

Contact Information

For general inquiries regarding this incident, Waseda email addresses, password changes, multifactor authentication, and related matters (including inquiries from alumni)
IT Help Desk Inquiry Form: https://support.waseda.jp/s/wits-emergency-form
Telephone: 0120-200-042 (Weekdays, 9:00 a.m.–5:00 p.m.; assistance available in Japanese only)

For media inquiries
Media Inquiry Form: https://www.waseda.jp/top/en/for-business/media