For: current students, staff, former students, former staff and related persons of Saga University, and patients of Saga University Hospital and their families. This article is based on Saga University's official notices and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
- Who is affected
current students, staff, former students, former staff and related persons of Saga University, and patients of Saga University Hospital and their families.
- Confirmed so farSee the table ↓
- Ransomware damage
- Recovery of administrative terminals
Listed as possibly affected
- Name, date of birth, sex, address, phone number, email address
- Password
- Patient information (clinical department, disease or injury name, date of visit and so on)
2 more
- Number of students, staff and others
- Whether data was taken
- Not yet confirmed
- The number of patients and which patients are covered (the university is investigating)
- The intrusion route and cause (an external specialist company is investigating; the notice gives no explanation)
- How passwords were stored (the notice does not say whether they were encrypted or hashed)
2 more
- Whether and when individuals will be contacted
- Whether the data was actually taken out (the notice says only that a leak "cannot be ruled out")
- What to do nowSee the steps ↓
- Work out whether you might fit
- Check messages claiming to be from the university or hospital without using their links or numbers
- Change your university password and any service where you reused it
3 more
- Patients and families: be especially suspicious of messages posing as the hospital
- If you have left, review old accounts and old passwords
- Use only the contact points in the notices
- Where to verify (source)All sources ↓
- Saga University, "事務情報システムにおけるランサムウェア被害の発生について" (ransomware damage on the administrative information systems, October 30, 2026, checked November 2)
- Last checked
- As of November 2, 2026
Follow-up plans and what we checked
In its October 30 notice the university says it will continue the investigation, strengthen its information security measures further and work to prevent a recurrence. On November 2 we checked the university's notice pages and the university hospital's website and found nothing newer than the October 30 notice.
What people who may be affected should do today
Work out whether you might fit
According to the university, the group is about 80,000 students, staff, former students, former staff and related persons. Patient information is listed separately, and its number is under investigation. The notice does not say whether individuals will be contacted or how to check whether you are included (as of November 2).
The group is not limited to current students and staff: it includes people who have left and people who gave their information as related persons. If you left some years ago, start on the steps below without waiting for a message.
Check messages claiming to be from the university or hospital without using their links or numbers
The university says suspicious emails, text messages and phone calls pretending to come from the university or related organisations may arrive in connection with this incident. It asks people not to open URLs or attachments in unexpected messages and not to enter personal information or passwords on suspicious websites.
A message with your correct name, address, date of birth and phone number is not proof that it is genuine. To check, use the university's official website (saga-u.ac.jp) that you open yourself, or a contact point shown in the notice, not the link or number in the message (how to spot fakes: What is phishing).
Change your university password and any service where you reused it
"Password" is among the listed items. The notice does not say whether the passwords were encrypted or hashed, so this site does not treat them as safe even if read (our judgment).
Change your university account password following the university's guidance, on a genuine screen you open yourself, never through a link in an email or text. If you use the same or a similar password on other services, change those first. To check, see How to check if your password leaked; for a tool to keep them separate, Choosing a password manager; and add multi-factor authentication where you can.
Patients and families: be especially suspicious of messages posing as the hospital
Patient information is special-care-required personal information such as clinical department, disease or injury name and date of visit. With it, someone can make convincing messages about "checking test results", "unpaid medical bills", "insurance procedures" or "rebooking a visit".
The university hospital's website (notice with an October 30 addition) apologises to patients and their families, says no secondary damage has been confirmed so far, and asks people to watch for suspicious contact. If a call, text or email asks about your treatment or payment, call back using a number from the hospital's official website, your patient card or a bill, not the one in the message.
If you have left, review old accounts and old passwords
Former students and staff rarely see notices from the university, so they are less likely to notice fake messages. Check for services tied to an old university email address or student ID that you no longer use.
Think about whether you still use a string similar to your university password anywhere else, and change it if so.
Use only the contact points in the notices
The university's contact point is its Public Relations Office (phone 0952-28-8153). The hospital's website points to a dedicated inquiry form (Saga University Medical Public Relations). The hospital says it will look into the facts and reply, and that the investigation may take time. Find the entrance to these from an official site you open yourself.
① A call, email or text claiming to be from the university or hospital (correct name, address or visit date do not settle it)
↓
② Do not use its links or numbers; check on an official site you open yourself or a contact point in the notice
↓
③-A Not on the official side / asks for a password or treatment details: do not comply
③-B The official side has the same notice: follow the official guidance
What happened (according to Saga University)
This is based on the university's notices of October 30 and September 28 and the hospital website's notice (checked on November 2).
September 24, 2026, 8:42
Confirmed damage thought to be caused by ransomware on a NAS (network-attached storage) used by administrative departments. Started initial response centred on its CSIRT (information security response team)Later, as part of the initial response (no time given)
Reported to the Ministry of Education and others, and consulted the policeSeptember 24, 16:45
Stopped use of administrative terminals to prevent the damage from spreading (September 28 notice)September 27, 11:03
Worked on recovery with the departments and companies concerned and resumed use of administrative terminalsSeptember 28
Normal operations resumed. The notice of that day said no impact had been found on systems related to education, research and clinical workAfter the September 27 restart
Asked an external specialist company to investigate and looked into the intrusion route and scope in detail (the notice gives no dates)October 30
Announced that it had confirmed it cannot rule out that personal information (including patient information) leaked outside the university. The hospital's website carries a notice whose title says "10/30追記" (added October 30)
- What happened
- At 8:42 a.m. on September 24, confirmed damage thought to be caused by ransomware on a NAS used by administrative departments
- What was found on October 30
- Confirmed that it cannot rule out that personal information it holds, including patient information, leaked outside the university
- Number affected
- Students, staff, former students, former staff and related persons: about 80,000 people. Patient information: under investigation
- Information involved
- (Students, staff, related persons) name, date of birth, sex, address, phone number, email address, password. (Patient information) special-care-required personal information (clinical department, disease or injury name, date of visit and so on)
- University response
- Initial response centred on the CSIRT, report to the Ministry of Education and others, consultation with the police, recovery with the departments and companies concerned, investigation by an external specialist company
- University's request
- Suspicious emails, texts and calls posing as the university or related organisations may arrive. Do not open URLs or attachments in unexpected messages, and do not enter personal information or passwords on suspicious websites
- University hospital's website
- A notice with an October 30 addition apologises to patients and families, says no secondary damage has been confirmed so far and asks people to watch for suspicious contact. There is a dedicated inquiry form
What is known and what is not
The state as of November 2, 2026. We will rewrite this table when more is published.
| Item | What the university said | Status |
|---|---|---|
| Ransomware damage | Confirmed at 8:42 on September 24 on a NAS used by administrative departments | Confirmed (university) |
| Recovery of administrative terminals | Use resumed at 11:03 on September 27; normal operations from September 28 | Confirmed (university) |
| Name, date of birth, sex, address, phone number, email address | Cannot rule out that it leaked outside. The count line says "students, staff, former students, former staff, related persons"; the parenthetical on the items line says "students, staff, related persons" | Possible (university) |
| Password | Listed among the items. Does not say whether encrypted or hashed | Possible (university) |
| How passwords were stored | Not stated | Not stated |
| Patient information (clinical department, disease or injury name, date of visit and so on) | Cannot rule out that special-care-required personal information leaked. Number under investigation | Possible (university) |
| Number of patients | Under investigation | Under investigation |
| Number of students, staff and others | About 80,000 people | Possible (university) |
| Intrusion route and cause | An external specialist company was asked to investigate. No explanation given | Under investigation |
| Whether data was taken | Says a leak "cannot be ruled out"; does not say removal was confirmed | Possible (university) |
| Misuse / secondary damage | Not stated in the university's notice. The hospital's website says no secondary damage has been confirmed so far | Not stated (university) |
| Contact with affected individuals | Not stated | Not stated |
| Regulators | The university describes reporting to the Ministry of Education and others and consulting the police. A report to the Personal Information Protection Commission is not mentioned. We found no statement from the authorities | Not stated |
A note on reading "cannot be ruled out" and "about 80,000 people"
The university says it confirmed that it cannot rule out that personal information leaked outside. It does not say the data was taken or misused. This site uses the university's wording as it is.
The figure of about 80,000 is for students, staff, former students, former staff and related persons. Patient information is on a separate line marked "under investigation", and the notice does not say whether patients are counted in the 80,000. Even if you do not know whether you are affected, the steps above are worth starting today.
What names, addresses, passwords and patient information can be used for
The following is what can generally happen with this combination of items, not something the university says has happened here.
- Name + address + phone number + email address: a target list for convincing calls, emails and texts posing as the university or a public body
- Date of birth + sex: material for messages pretending to verify your identity, and a clue for identity checks on other services
- Password: can be tried against other services where the same or a similar password is used. Because the storage form is not stated, change the university password itself as well
- Clinical department + disease name + date of visit: material for messages posing as a hospital, medical bills, insurance or test results. Do not talk about details you would not want known, such as a diagnosis, on the phone or on a linked page, whether or not the other party seems genuine
What operators should review
The intrusion route has not been published, so this covers only what the published timeline supports.
- The scope widened about five weeks after the first notice (September 25): the September 28 notice said no impact had been found on education, research or clinical systems. On October 30 it moved to saying it cannot rule out that personal information, including patient information, leaked. Working out early what was stored on the storage that was hit helps you report faster later
- Take stock of shared storage in administrative departments: check whether personal information, especially special-care-required personal information, sits on office file servers or NAS. The harder it is to tell which system the data belongs to, the longer it takes to pin down the scope
- How long to keep data on former users: this group includes former students and former staff. Decide how long, and where, you keep personal information after graduation or departure
- Keeping passwords: if you hold passwords, be able to explain what could happen on a leak, including how they are stored. Storing them in a form that cannot be turned back into the original string is the baseline
For how ransomware works and how to prepare, see What is ransomware; for cases where hospitals were stopped, see Hospitals stopped by cyberattacks in 2026.
Sources (public records)
The facts in this article rest on the public information below. We do not speculate about intrusion routes or methods that have not been published.
- Saga University, "事務情報システムにおけるランサムウェア被害の発生について" (ransomware damage on the administrative information systems, October 30, 2026, checked November 2) — saga-u.ac.jp (same notice in the listing: saga-u.ac.jp)
- Saga University, first notice (published September 25, 2026, per our records) — saga-u.ac.jp
- Saga University, "事務情報システムにおけるランサムウェア被害の発生について" (September 28, 2026, checked November 2) — saga-u.ac.jp
- Saga University Hospital, "【お詫び】事務情報システムにおけるランサムウェア被害の発生について（10/30追記）" (apology notice with an October 30 addition, checked November 2) — hospital.med.saga-u.ac.jp
Update history
2026-11-02: First version. Based on the university's October 30 notice (cannot rule out that personal information and patient information leaked; about 80,000 people), its September 28 notice and the university hospital website's notice (checked November 2; nothing newer than October 30 found).
Read next
- Preparing for fake messages: What is phishing / Choosing a password manager
- Ransomware and backups: What is ransomware / Backup essentials (the 3-2-1 rule)
- Similar cases in Japan: Osaka Metropolitan University ransomware attack / Hospitals stopped by cyberattacks in 2026
- Other 2026 incidents: Data breaches and cyberattacks list (Japan and overseas)