Attackers exploit a known medium‑severity vulnerability, used a maintenance account, and access names, emails and phone numbers; officials pledge recurrence prevention

On 11 September 2026, Japan’s Digital Agency announced that unauthorized access to its Government Solution Service (GSS) — a shared working environment used across ministries — may have leaked about 246,000 personal records.

Investigators believe attackers had exploited a known, medium‑severity vulnerability in a VPN device around late May, then used a maintenance operations account to access files at scale. Suspicious activity was detected on 25 June 2026; the agency confirmed the cause on 9 July and cut the account and external connections the same day.

Exposed attributes include names, email addresses and phone numbers of public officials, contractors and business operators; no My Number IDs, bank details or pension numbers were exposed. The agency said no secondary misuse has been confirmed so far.

The Digital Agency said the affected records cover roughly 189,000 staff from GSS‑using organizations and about 57,000 contractors and related businesses.  It has implemented patches and other measures and said the risk of further damage is very low, according to World Cybersecurity News.

Reactions for the lapse

Digital Minister Hisashi Matsumoto told reporters the agency “take[s] this matter extremely seriously” and would review vulnerability management and external connection procedures.

The breach underscores the importance of identity security, said Takanori Nishiyama, Senior Vice President (APAC) and country manager (Japan), Keeper Security. He argued that the best defense is zero standing privilege, least‑privilege and just‑in‑time access, alongside strong multi‑factor authentication.

Chief Cabinet Secretary Minoru Kihara has noted that the incident occurred “despite our operations under multi-layered security measures” and pledged work to prevent a recurrence, according to reporting from The Star.

According to the National Police Agency’s threat report for 2025, cited in coverage of the breach, VPN devices accounted for two‑thirds of ransomware intrusion routes in Japan, with 43.7% of entry devices already patched — pointing to stolen credentials, weak passwords and misconfiguration as key gaps.

Other reports have noted how the cybersecurity resources of Japan, at just under 900 personnel as of March 2026, are insufficient compared to the 6,200 people in its US counterparts.