Japan’s Digital Agency Breach Exposes Data on 240,000 People

Japan’s Digital Agency has disclosed a data breach affecting approximately 240,000 people. The incident was discovered in late June after attackers used a maintenance and operations employee’s account to access files in the agency’s Government Solution Service (GSS). An investigation in July found that the attackers had exploited a vulnerability in a VPN product, which the agency said had already been publicly disclosed. The product was not identified.

The agency said more than 246,000 records were compromised, including approximately 236,000 names, 1,000 addresses, 231,000 email addresses and 94,000 telephone numbers. The affected people include GSS users, public officials, administrative staff, and businesses and individuals working with the service. Most addresses and telephone numbers were linked to workplaces, such as government buildings or offices. Individual identification numbers and financial account information were not affected.

The agency blocked external access to the affected server and suspended the employee account after confirming the exploitation. It said no other systems were compromised and that the breach did not involve information belonging to the general public. In response, it plans to strengthen vulnerability management, particularly after the attackers exploited a vulnerability that had already been publicly disclosed.