SafePay ransomware claims attack on Japan's Jumonji University
The SafePay ransomware group listed Jumonji University (Jumonji Gakuen Women's University), a private university in Niiza, Saitama, Japan, on its leak site on Oct 26, 2026, according to DailyDarkWeb. The group shared no details on the volume or type of data allegedly taken, the claim is unverified and the university has posted no notice. If the claim holds, students and staff should expect university-themed phishing.
What happened
The SafePay ransomware group listed Jumonji University, a private institution in Niiza, Saitama, Japan, on its leak site on Oct 26, 2026. The group disclosed no volume or type of allegedly stolen data. The claim is unverified and the university has posted no incident notice.
Why it matters
If confirmed, student, staff and applicant records could be exposed, since universities hold such data, per the analyst note. That data could fuel phishing scams aimed at the academic community. For now, this is only a threat-actor claim, with no confirmation from the victim.
What to do
Watch for an official statement from the university and monitor the SafePay leak site. Tell students and staff not to open unexpected attachments or click password-reset links.
For the technical team
- Affected
- Jumonji Gakuen Educational Corporation Jumonji University (Jumonji Gakuen Women's University, universidade particular em Niiza, Saitama, Japão) · Jumonji University (Jumonji Gakuen Women's University), private, in Niiza, Saitama, run by the Jumonji Gakuen Educational Corporation. Alleged victim; no product or version cited in the sources.
- Exploitation
- Claim by the SafePay group, reported by DailyDarkWeb. Leak-site listing on Oct 26, 2026 (UTC). No independent verification, no university confirmation, and no details on data volume or type.
- Fix
- Not applicable. Mitigation cited in the source: do not open unexpected attachments or password-reset links.
- More details
- Universities hold student, staff and applicant records. DailyDarkWeb analyst note: unverified threat-actor claim, with no confirmation of a breach. If the claim holds, expect university-themed phishing.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb



