JP — ITmedia

NEC Apologizes for Information Leak at Contractor, Says It Is Reflecting as a Security Business

SecurityOctober 28, 20262 min read

NEC apologized at its quarterly results briefing for a security incident at a subcontractor. The company said that, as a security business, it should have done better.

NEC apologizes for a leak at a subcontractor

On October 28, 2026, NEC Vice President and CFO Kazukazu Amemiya apologized during a question-and-answer session at the second-quarter results briefing. He said NEC itself had also had a similar incident. He said the company was very sorry that an incident happened, since NEC sells security services. NEC says it is putting customer trust first and strengthening its management system.

Key facts

In late September, a system development and maintenance subcontractor was hit by a cyberattack.
The attacker used stolen legitimate account login details to get into customer systems and lock server files.
Osaka University said about 78,000 records of students, graduates and staff may have leaked.
Security-related sales were roughly 70 to 80 billion yen across IT services and social infrastructure, according to Amemiya.
BluStellar, NEC's domestic digital transformation (DX) business, grew sales by 29.5% in the first half compared with a year earlier.

What led to this

NEC said it had shared customer and subcontractor files through a cloud storage service. Personal data in those files also leaked. At Osaka University, a third party downloaded files that NEC had shared with a partner company without telling the university. Osaka Metropolitan University also said a major system failure on October 2 was caused by a cyberattack on an NEC subcontractor.

Why it matters

Many companies are being attacked, and AI is making attacks much more common, according to Amemiya. Security is now a key area that companies and local governments must protect. For NEC, the problem is also a test of trust, because it sells security services. Amemiya said more incidents would have little short-term effect on NEC's profits. Customers are first asking for advice on new ways to protect themselves.

What to watch

How NEC strengthens control over its subcontractors and the files it shares.
Whether more customers, such as banks, ask NEC for security and AI help.
How NEC uses AI tools to find weak points in company systems, including its participation in Anthropic's Project Glasswing.

Glossary

NEC: A Japanese IT and electronics company that sells systems, AI and security services.
BluStellar: NEC's DX business in Japan, which offers digital and security services to companies.
Project Glasswing: An Anthropic security effort that NEC joined in September to use AI for finding and fixing weaknesses.

Unauthorized Access to JAL Reservation System Exposes Data of About 90,000 People, Including Passport Numbers for Some

Japan Airlines (JAL) and Japan Transocean Air (JTA) said that a provider of their reservation and check-in management system was accessed without authorization, and that reservation data for about 92,000 customers may have been viewed from outside. For about 2,000 of them, passport numbers, phone numbers, and other details may also have been viewed, while the companies said there was no sign of credit card numbers or passwords being leaked and no effect on flight operations. The affected provider, Amadeus IT Group, reported the intrusion on October 23, has completed necessary security measures, and has not confirmed any misuse of the information as of October 28.

SecurityThe RegisterOct 28

123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus

UK domain registrar 123 Reg says it suffered an "AI-driven cyberattack" on September 18 that exposed customer data, including contact details, VAT numbers and API product information. The company says its investigation found attacker infrastructure hosted in China and Singapore and suspects a China-linked group, possibly the same actor that used the open-source ARTEX tool against South Korean financial institutions. 123 Reg says it believes the attacker only read customer data but may have made copies, and has urged customers to be wary of unsolicited messages.

SecurityArs TechnicaOct 28

China’s snooping around Pacific undersea cables raises risks for Big Tech

A new report says subsea cables owned by US companies such as Google and Meta face some of the greatest risks of deep-sea sabotage in the Pacific Ocean, as Chinese research ships spend unusual amounts of time apparently surveying cables. The report, contracted to the London-based China Strategic Risks Institute and published by the US-China Economic and Security Review Commission in September 2026, includes an interactive Trans-Pacific Cable Gray Zone Vulnerability Index that ranks at-risk cables using factors such as depth, shipping traffic, ownership, and whether a cable connects to Taiwan.

SecurityITmediaOct 28

"Servers with Delayed Security Measures Are Being Targeted Across the Board": Luck CTO Warns Amid Successive Unauthorized Access

At KDDI SUMMIT 2026 on October 28, Luck CTO Hiroaki Kuramochi said that systems with postponed security measures, such as delayed vulnerability assessments, lack of WAF, or outdated PHP versions, are being targeted across the board. He noted that AI has sharply reduced the cost and time needed for attackers to scan systems and exploit vulnerabilities, and that infostealer malware is stealing employee credentials, making perimeter monitoring alone insufficient. He recommended deploying EDR on servers and penetration testing, and said AI has not created entirely new problems but has exposed long-overlooked weaknesses.