Industry
According to FTV News, Kang Chiao International School's Linkou campus confirmed to parents that its network systems were breached, and several parents and staff received threatening emails signed by the "Osiris ransomware group" .
The Japan Chamber of Commerce and Industry (JCCI) announced on Nov 10 that the external exam management server used for its online tests was accessed without authorization, and data of up to about 980,000 examinees (about 1.
Vanderbilt University said on Nov 9 it is responding to an active cybersecurity incident that may impact university devices, systems and cloud-based services, and that its IT team is investigating and working to contain it .
York University in Toronto announced that an unauthorized actor accessed some online forms used by its departments and stole personal information, an incident it became aware of on October 25, 2026 .
Security firm Todyl says that since Nov 1 an attacker has been using stolen, still-valid credentials to sign in to MSPs' Microsoft 365 and Azure environments as their own applications, targeting about 45 app registrations at roughly 18 organizations with more than 33 authenticating successfully .
According to reports by the United Daily News and China Times, a written operational report submitted by the National Security Bureau (NSB) to the Legislative Yuan on October 20 stated that through September, Taiwan's Government Service Network (GSN) experienced an average of over 2.
K-12 administration software provider Frontline Education said it identified unauthorized activity tied to a vulnerability in a third-party software product on Aug 14, 2026, which allowed access to part of its environment, with the last unauthorized activity on Aug 15 .
LMU Munich notified under GDPR Article 34 on September 19 that an unauthorized actor accessed student registration data stored in an IT system and that it must assume the data were retrieved .
Mathspace said attackers exploited a vulnerability in its self-hosted Metabase internal reporting system to gain admin access, with access dating back to August 10 and data downloaded from its Australian reporting database on August 27; Metabase had released patches on August 6, but Mathspace only updated on August 29 .
Instructure said the attacker used a Free-for-Teacher account to submit a support ticket with malicious code that triggered an XSS flaw, obtained an authorization token and gained elevated access in Canvas, taking usernames, email addresses, course names, enrollment information and messages .
According to BleepingComputer, ShinyHunters leaked data from 13.
According to BleepingComputer, South Korean education group Kyowon confirmed a ransomware attack in which data was exfiltrated and is investigating with authorities whether customer information was included .
According to Security NEXT, Keio University detected anomalous communications originating from a spam quarantine server at its Shonan Fujisawa Campus in late November 2025 .
According to Security NEXT, Ryokkyukai, the alumni association of Otaru University of Commerce, announced that one of its computers suffered an external intrusion, potentially exposing member personal data .
According to LOG, citing a notification from Turkey's Personal Data Protection Authority (KVKK), systems at a company processing data on behalf of Istanbul Gedik University suffered unauthorized access .
According to Security NEXT, Ako City in Hyogo Prefecture was notified by its outsourced IT contractor on December 18, 2024, confirming that data on a Board of Education server had been encrypted by ransomware .
According to Security NEXT, Schoo announced that an error in trial account management for the group learning feature of Schoo for Business allowed certain users to view personal information of other users .
According to Security NEXT, on the evening of December 17, 2024, a prefectural high school in Saitama Prefecture uploaded a seminar video intended only for students but mistakenly set its visibility permissions to public .
According to Security NEXT, JPCERT/CC warned in 2024 against focusing solely on VPN vulnerabilities, citing a 2023 watering hole attack targeting university-affiliated individuals .
According to Security NEXT, a municipal junior high school teacher in Kariya City lost a personal USB flash drive at a commercial facility while returning home on October 4, 2024 .