（First posted on 11th of October 2019）
This is an update to the earlier report about “Apology and Caution about Phishing” on the Website of Kanazawa University on 4th of October 2019 as below.
41,967 phishing mails were sent from these accounts to various organizations and people due to the compromise of our staff from 20th of September 2019 to 27th of September 2019.Furthermore, we found there was possibility that private information was leaked by illegal access.
Although there is no report about damage caused by information leak, we sincerely apologize to people who had trouble and anxiety about this incident.
We assure that we shall take necessary measures to prevent such an incident in the future, in sincerity.
Naoki HIMIYA
Chief Information Security Officer
National University Corporation
Kanazawa University
11th of October 2019
Private information which could be leaked by illegal access.
Target email：251 messages on the email
Private Information of people outside Kanazawa University
Case 1: Name and email address: 6 persons
Case 2: Name, email address, business address, affiliation and phone number: 20 persons
Private Information of people inside Kanazawa University
Case 1: Name and email address: 7 persons
Case 2: Name, email address, business address, affiliation and phone number: 33 persons
We have already apologized to the persons of possibility that private information was leaked by illegal access.
1. Summary of the incident
Phishing emails, in English, which led to fake website that prompted authentication were sent to Kanazawa University, impersonating Information Media Center, Kanazawa University. The phishing mails were sent on the 14th of August and 20th of September 2019.
Additional 41,967 phishing mails were sent from 7 out of 25 accounts to various organizations and persons on the 20th, 25th, and 27th of September 2019.
Furthermore, there is a possibility that 251 messages that were sent may contain private information, which was leaked by illegal access, before the passwords of those email accounts could be changed.
2. What we did with the incident
・We finished changing all the passwords of the email accounts which were accessed illegally.
・We asked all students and staffs to change their email passwords and remain vigilant of phishing emails.
・We are limiting the number of emails that could be sent at a time.
・We are improving email system access management.
3. What we are going to do in the future
・Students and staff will receive additional measures regarding email usage regulations. Furthermore, Multi-factor authentication and other additional security measures will be implemented.
・Should there be any further updates, we will report on this website.
4. Our request for cooperation
If you receive an email showing “Kanazawa University” or 「金沢大学」 as sender or tittle, please be aware of the message content. Please be especially aware of suspicious email and telephone contacts.
The following is a sample of the phishing mail:
——————————————————————–
差出人: Kanazawa University <**** @ ***.kanazawa-u.ac.jp>
件名: “Email Confirmation!” or “Recover rejected emails!” or “Incoming email rejected 001”
本文：
As of [date][time], Kanazawa University Email System was unable to deliver 4 new messages to your [mail-address] inbox To recover rejected emails, please visit the link below and log in
<<Recover_mails>>(※1)
Kanazawa University Media Center,
© 2003-2019 Information Media Center, Kanazawa University.
——————————————————————–
※1 "<<Recover_mails>>" was the link to the phishing site.
Press contact
Public Relations Office
General Affairs Department
Kanazawa University
TEL:+81-76-264-5024
PAGE TOP