Waseda says 3,342 MyWaseda records were obtained in unauthorized access

Waseda says an unauthorized third party obtained 3,342 MyWaseda-related records; the figure counts records, not unique people, and the intrusion route remains under investigation.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

A glowing shield with a campus building and padlock floats in a university computer lab, surrounded by abstract account cards and red warning icons.
AI-generated editorial illustration of a MyWaseda-related credential breach in a university computer lab; not an official Waseda image or documentary scene.

Waseda says 3,342 MyWaseda records were obtained in unauthorized access

Waseda University says a third party gained unauthorized access to a system that manages personal information used for MyWaseda logins.12 Its investigation found that the third party obtained 3,342 records.1

Official notice dated November 9, 2026.1 • Reporting cutoff: November 9, 2026, 3:13:23 AM EST / 2026-11-09T08:13:23Z / November 9, 2026, 5:13:23 PM JST

The bottom line

The 3,342 figure is a count of records, not unique people; Waseda says one user may have multiple email addresses.1 Password information in the affected records was stored in encrypted form rather than in the same form users entered it.1

Verified facts

Incident dateWaseda says the unauthorized access occurred on August 31, 2026.1
Two record groupsThe total comprises 81 individual-information records and 3,261 staff-and-other-user records.1
Portal roleThe affected system manages user information used to log in to MyWaseda, the university portal for email and other services.1

What the records contained

The 81-record group breaks down into 38 records containing name and affiliation category, 23 containing name, affiliation category and Waseda email address, and 20 containing name and encrypted-form password information.1

The 3,261-record group contained faculty or staff ID number, name, Waseda email address, department name, affiliation category and encrypted-form password information together as one set.1

How Waseda found it — and the PHP boundary

Waseda says it found evidence of the August 31 access while reviewing system security in response to a PHP vulnerability, then expanded the investigation and confirmed the intrusion and acquisition of information.1 A separate October 22 notice said Waseda had imposed preventive access restrictions on MyWaseda and other PHP-based systems while addressing a PHP vulnerability.3

Causality limit: Waseda’s breach notice does not say the PHP vulnerability caused the unauthorized access or identify the intrusion route; it says the access came to light during the PHP-related security review.1

Response and current restrictions

Waseda says it suspended relevant systems, restricted external communications and access, changed system-administrator passwords, limited related services, engaged an external cybersecurity specialist and reported or consulted with relevant authorities.1

Students, faculty and staff are being individually told necessary actions, including changing Waseda email passwords.1 For alumni, Waseda temporarily suspended MyWaseda and other Waseda ID services, including Waseda email and certificate issuance, until security is confirmed.1

What this means for readers

  • If Waseda contacts you with individual instructions, follow its password-change directions for your Waseda email account.1
  • Be cautious with unsolicited or unfamiliar email, SMS or other messages claiming to be from Waseda or related parties.1
  • Do not follow unfamiliar links, open attachments, or enter IDs or passwords in response to those messages.1

What remains unknown

Waseda says it is still investigating the intrusion route, whether additional information was obtained and the scope of impact.1 It has not ruled out acquisition of information beyond the two disclosed record groups.1

At the reporting cutoff, Waseda said it had not confirmed impact on information relating to admissions applicants or Waseda University Open College participants.1 That is a bounded no-confirmed-impact statement, not proof that impact is impossible.

Sources

  1. Notice Regarding a Personal Information Breach Caused by Unauthorized Access — Waseda University English notice, dated November 9, 2026.
  2. 不正アクセスによる個人情報漏えいについて — Waseda University Japanese original, dated November 9, 2026.
  3. PHPの脆弱性対応に伴う一部サービスへのアクセス制限について — Waseda University prior service-restriction notice, dated October 22, 2026.

Reporting note: This article reports the public sources available at the stated cutoff. It does not promise future updates.

Browse Articles

Latest Articles