Japan's Digital Agency discloses data breach affecting 246,000 people

Japan’s Digital Agency said Friday that personal information belonging to about 246,000 people, most of them government employees, may have been exposed after hackers exploited a vulnerability in a virtual private network device used by the Government Solution Service.

The agency said it detected suspicious activity from the account of a system maintenance administrator on June 25 after a large volume of files were accessed on the Government Solution Service network, a system commonly used by government ministries and agencies. A subsequent investigation found that an external third party had exploited a VPN vulnerability to gain unauthorized access, repeatedly accessing the system since around late May, and that the intrusion was discovered on July 9. The agency said it suspended the maintenance account, cut off communication between the compromised equipment and the outside world, and prevented further unauthorized access the same day.

The Digital Agency said it was aware of the VPN vulnerability but had not yet applied a patch when the breach occurred. It described the flaw separately as having a medium severity rating and said it was not a zero-day vulnerability, though it did not disclose which VPN product was affected.

The agency’s investigation found that the exposed data may include 236,000 names, 231,000 email addresses, 94,000 telephone numbers and 1,000 physical addresses.

The breach affects about 189,000 government employees and roughly 57,000 private-sector workers involved in government duties, along with public officials and businesses and individuals who use the GSS system. The agency said the exposed information did not include My Number personal identification numbers, bank account details or pension numbers, and that no personal data belonging to the general public was involved.

The Digital Agency said it has not confirmed any misuse of the exposed information but warned of an elevated risk of impersonation and phishing, urging people not to open links or attachments in unsolicited emails or messages. The agency said it will never ask for passwords or credit card information by email or phone and is contacting affected individuals directly through a dedicated support line.

The agency notified Japan’s Personal Information Protection Commission on July 15. It said the delay before disclosing the incident publicly was due to the complexity of determining how the intrusion occurred, identifying which information was affected and establishing who was affected. The agency said the impact was limited to the compromised system, with no confirmed unauthorized access or data leakage affecting other systems, and that the incident did not disrupt government services.

Chief Cabinet Secretary Minoru Kihara said at a news conference that the government takes the incident seriously given that it occurred despite multilayered security measures and round-the-clock surveillance, adding that the agency would work to prevent a recurrence.