Short answer
Saga University found files on an administrative NAS being encrypted on 24 September 2026 and later said ransomware had hit part of its administrative information system. On 30 October it said personal data of about 80,000 people may have leaked, including hospital patient information.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Saga University |
|---|---|
| Incident type | Ransomware |
| Status | Confirmed by the organization |
| Sector | Education and university hospital |
| Country | Japan |
| Detected | 2026-09-24 |
| Disclosed | 2026-09-30 |
| People or records affected | Personal information of about 80,000 people may have leaked. Patient numbers were not given. |
What data was exposed
- Personal information of students, faculty and staff (the specific fields were not itemized in the reports we read)
- Patient information from the university hospital, including diagnoses, possibly leaked
What happened
At 8:42 a.m. on 24 September 2026, Saga University found files on a network storage device (NAS) used by its administrative department being encrypted, according to ScanNetSecurity. It treated the event as ransomware. The university’s CSIRT began its initial response, and administrative terminals were shut down that afternoon to limit spread. The university consulted police and worked with vendors on recovery.
Administrative terminals came back into use on 27 September and normal operations resumed on 28 September. That first announcement described encryption of files and did not say whether data had left the university.
The 30 October update
On 30 October 2026 the university said personal information of about 80,000 people may have leaked, NHK reported. Those people include students, faculty and staff. NHK also reports that information on patients of the university hospital, including diagnoses, may be affected. The reports we read do not say how many patients, which exact fields were held on the affected system, or whether the attackers have published anything.
We have not seen the university’s own notice, so the specific data fields remain unlisted here. If you are a current or former student, employee or patient, check the university’s website for what applies to you.
Why this matters
Administrative file servers at universities often hold years of records: enrollment, payroll, contact details and, at a university with a hospital, health information. When a possible leak is announced weeks after the first alert, scammers know people are watching their inboxes. Expect messages that borrow the university’s name, and, for patients, calls that mention real treatments.
Our guide to phishing messages explains how to check a link before you click, and what to do after a data breach covers password changes and monitoring. If someone threatens to publish your records, see the notes on pressure tactics in our recovery scams guide, since criminals also pose as helpers who can “remove” leaked data for a fee.
What we do not know
The attack vector, the ransomware group, and any ransom demand have not been reported in the sources we read. The first report shows the university restored operations within four days, which says nothing about whether copies of the data were taken. We will update this page when the university publishes more detail. See our editorial policy.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Emails or texts posing as the university, its hospital or the police asking you to confirm personal details through a link
- Calls to patients that quote a diagnosis or visit and ask for payment or insurance details
- Extortion messages claiming to hold your records and demanding payment
What to do if you are affected
- 01Wait for notices from Saga University and use only contact details published on its official site.
- 02Do not click links or open attachments in messages about the incident that you did not expect.
- 03Change passwords you reuse across services, in particular any tied to your university email.
- 04If someone threatens to publish your records, do not pay. Keep the message and report it to the police or the prefectural cybercrime consultation desk.
- 05Hospital patients should treat unsolicited calls about their treatment or bills as suspect and call the hospital back on its published number.
Frequently asked questions
How many people may be affected by the Saga University ransomware attack?
NHK reports the university said personal information of about 80,000 people may have leaked. It did not give a separate count of hospital patients.
When was the attack detected?
ScanNetSecurity reports that at 8:42 a.m. on 24 September 2026 the university found files on an administrative NAS being encrypted and presumed ransomware.
Was the data actually stolen?
The university says it may have leaked. The September report covered encryption only, and the 30 October announcement is phrased as a possibility. No publication of the data was reported in the sources we read.
Were hospital systems affected?
The September report did not mention an effect on teaching, research or clinical systems. NHK says patient information, including diagnoses, may have leaked.
Did the university involve the police?
Yes. ScanNetSecurity says the university consulted police in the initial response.
Sources
- Saga University ransomware, personal information of about 80,000 may have leaked, NHK, 2026-10-30
- Ransomware attack on Saga University NAS, files encrypted, ScanNetSecurity, 2026-09-30
This post summarises public reporting as of 2026-11-05. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.