Keio University Confirms Data Breach Affecting Thousands of SFC-CNS Email Accounts Keio University’s Shonan Fujisawa Campus (SFC) has disclosed a data breach involving its SFC-CNS email service, likely exposing sensitive information of thousands of users. The incident, detected on November 26, 2025, stemmed from unauthorized access to the university’s spam quarantine server, which was later found to have been exploited via a zero-day vulnerability in its software. Investigations revealed that attackers may have accessed data from the directory server, which stores user credentials and personal information. On December 22, the university confirmed that 6,447 accounts—including those of current students, faculty, staff, recent graduates, and suspended users—were compromised. Exposed data includes email addresses, hashed account login passwords, plaintext email passwords, Wi-Fi passwords (reversibly encrypted), full names, ID numbers, and forwarding email addresses. An additional 1,025 March 2025 graduates had only their email addresses exposed. The spam quarantine server, which stores flagged emails, may have also leaked up to 222,508 messages (linked to 984 email addresses) and 1,613 safe/block list entries, though the university assessed the risk of large-scale data exfiltration from this server as low. In response, Keio University mandated password resets for all affected accounts—first for email services on December 23 and later for account logins on December 25. The incident has been reported to government agencies and law enforcement, though no secondary misuse of compromised data has been confirmed to date. The university continues to monitor the situation and implement additional security measures.