Osaka Metropolitan University has suffered a ransomware attack that disrupted the university’s information infrastructure and left major systems unavailable. The university said the incident began in the early hours of October 2, 2026, and has affected its website, email, campus network and several systems used for education and administration. According to the university, a large-scale failure occurred within its virtualization infrastructure on October 2. The incident initially rendered many information systems unusable. The university later determined that the disruption was caused by a cyberattack, specifically a ransomware attack. The university established a crisis management headquarters on the same day, led by President and Vice Chairman Hiroyuki Sakuragi. External specialists are supporting the investigation into the cause of the attack and the extent of the damage. The outage has affected a broad range of services, including the campus network, OMU email, corporate and university websites, educational support systems, academic affairs systems, financial accounting systems, human resources and payroll systems, and library systems.

Data of 130,000 Students and Teachers May Be Exposed Due to Ransomware Attack

Japanese media reported that data belonging to at least 130,000 current and former students and teachers at the institution may have been exposed to unauthorized access following the cyberattack. The university has not yet confirmed whether personal information was leaked. It said an investigation is underway to determine whether any personal information was compromised and to establish the facts surrounding the incident. The university said it will report the matter to Japan’s Personal Information Protection Commission and proceed with further fact-finding based on an investigation by a specialized company.

Osaka Metropolitan University Works to Restore Operations

Osaka Metropolitan University said it is prioritizing the investigation, damage assessment and restoration of affected systems. It is also using alternative measures to maintain essential operations and provide support to students, prospective students, business partners and other stakeholders. The university has temporarily established an announcement site because its official website, email system and other services remain unavailable. The temporary site is being used to publish information from Osaka Metropolitan University, the National College of Technology and affiliated hospitals. The university is also preparing for classes to resume from Friday, October 9, and has asked students to check the temporary announcements for information regarding the resumption of classes.

Japanese Organizations Face Recent Cyber Incidents

The Osaka Metropolitan University ransomware attack comes amid several recent cyber incidents disclosed by organizations in Japan. Over the weekend, Japanese media giant Nikkei disclosed that a compromised employee account had been used to send approximately 9,000 malicious emails to internal and external contacts, including journalistic sources. Other Japanese organizations that have recently disclosed cyber incidents include brokerage Daiwa Securities, delivery companies Yamato Transport and Sagawa Express, insurer Dai-ichi Life and broadcast equipment manufacturer Ikegami Tsushinki. Osaka Metropolitan University said it has reported the incident to the Ministry of Education, Culture, Sports, Science and Technology, the Osaka Prefectural and Osaka City governments, and JPCERT. The university said it will provide further information as new facts emerge.

Boston Scientific said a cyberattack detected this Tuesday, caused a network outage and cut off its ability to process and ship customer orders globally, and the medical device maker has not been able to say when full service will return.

The company disclosed the incident in an 8-K filed with the Securities and Exchange Commission on Wednesday and in a statement on its official website. It said the intrusion affected certain information technology systems and limited access to business applications underpinning day-to-day operations.

Boston Scientific is among the world's largest medical device manufacturers, reporting $20.07 billion in 2025 revenue and about $21 billion over the trailing 12 months. Its portfolio includes pacemakers, defibrillators, cardiac stents and neuromodulation implants, and the company says its products treat roughly 48 million patients a year. Thousands of employees in Ireland, where Boston Scientific operates three manufacturing and research sites, were told to work from home on August 26 after network communications were severed.

The company said it activated incident response protocols and engaged outside cybersecurity specialists to contain and investigate the intrusion. It has not said whether ransomware was involved, whether data was exfiltrated, or whether the disruption touches patients with implanted devices. No extortion group had claimed responsibility as of August 26. Shares fell more than 4% following the disclosure.

A Boston Scientific spokesperson declined to answer questions about patient impact and directed reporters to the published statement. Neither the company nor U.S. regulators have said whether hospital procedures have been delayed as a result of the shipping halt, though device suppliers typically hold limited on-site inventory at hospitals, making sustained order outages a downstream supply concern.

The incident is the third disruptive attack on a major medical technology firm in six months. Stryker suffered a global network outage in March after attackers abused its Microsoft Intune deployment to wipe data from thousands of devices, and Medtronic disclosed in April that patient names, Social Security numbers and health information were exposed in a breach attributed to the ShinyHunters extortion group.

Also read: Stryker Says Cyberattack Disrupted Processing, Manufacturing and Shipping

Boston Scientific said it cannot yet assess the full operational and financial impact, language that leaves room for an amended filing once the investigation matures.

The company's Irish footprint also raises the prospect of European scrutiny. If personal data proves to have been accessed, notification duties under the General Data Protection Regulation would attach, and medical device manufacturers operating in the European Union are increasingly captured by the NIS2 Directive's incident reporting regime as member states complete transposition.