Data Breach Affects 240,000 at Japan’s Digital Agency

Post Views: 1

Japan’s Digital Agency has disclosed a data breach impacting the personal data of approximately 240,000 individuals.

The incident was identified in late June when unauthorized access was detected to files within the Government Solution Service (GSS) via a maintenance and operations employee’s account. Subsequent investigations in July revealed that a vulnerability in a VPN product was exploited to gain entry into the system. The agency reported that over 246,000 records were compromised, including names (approximately 236,000), addresses (around 1,000), additional addresses (approximately 231,000), and phone numbers (roughly 94,000). The affected data pertains to users, public officials, administrative staff, and businesses or individuals associated with GSS. The information was provided by individuals during their application process to utilize GSS services, with most addresses and phone numbers linked to their workplace, such as government buildings or offices, as outlined in the agency’s FAQ. Other personal details, including individual identification numbers and financial account information, remained unaffected. The agency promptly blocked external access to the compromised server and suspended the employee’s account following confirmation of the breach. Although the specific VPN product exploited was not disclosed, the agency noted that the vulnerability had been publicly identified prior to the attack.

No additional systems were compromised, and no data from the general public was exposed, according to the agency’s statement.