Japan’s Digital Agency Suffers Data Breach Impacting 240,000 Individuals
Japan’s Digital Agency confirmed a data breach exposing the personal information of approximately 240,000 individuals. The incident was detected in late June after attackers accessed files from the Government Solution Service (GSS) using a compromised maintenance and operations employee’s account.
An investigation in July revealed that the breach stemmed from an exploited vulnerability in an unnamed VPN product. The compromised data included 236,000 names, 1,000 addresses, 231,000 email addresses, and 94,000 phone numbers primarily tied to workplace details of users, public officials, administrative staff, and businesses interacting with GSS. No financial account information or individual identification numbers were affected.
Upon discovery, the agency immediately blocked external access to the affected server and suspended the compromised employee account. While no other systems were breached and the general public’s data remained secure, the agency acknowledged that the exploited vulnerability had been publicly disclosed prior to the attack. As a result, it plans to enhance vulnerability management protocols.
The breach highlights the risks of unpatched security flaws in critical government infrastructure.
Source: https://www.securityweek.com/240000-hit-by-data-breach-at-japans-digital-agency/
Digital Agency, Government of Japan cybersecurity rating report: https://www.rankiteo.com/company/digital-agency-of-japan
"id": "DIG1789511183",
"linkid": "digital-agency-of-japan",
"type": "Breach",
"date": "6/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '240,000 individuals (users, '
'public officials, '
'administrative staff, and '
'businesses interacting with '
'GSS)',
'industry': 'Government',
'location': 'Japan',
'name': 'Japan’s Digital Agency (Government Solution '
'Service - GSS)',
'type': 'Government Agency'}],
'attack_vector': 'Compromised employee account, Exploited VPN vulnerability',
'data_breach': {'number_of_records_exposed': '240,000 individuals',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'Workplace details, personal contact '
'information',
'type_of_data_compromised': ['Names',
'Addresses',
'Email addresses',
'Phone numbers']},
'date_detected': '2023-06-XX',
'description': 'Japan’s Digital Agency confirmed a data breach exposing the '
'personal information of approximately 240,000 individuals. '
'The incident was detected in late June after attackers '
'accessed files from the Government Solution Service (GSS) '
'using a compromised maintenance and operations employee’s '
'account. The breach stemmed from an exploited vulnerability '
'in an unnamed VPN product.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Personal information of 240,000 individuals',
'identity_theft_risk': 'Yes',
'operational_impact': 'Blocked external access to affected server, '
'suspended compromised employee account',
'payment_information_risk': 'No',
'systems_affected': 'Government Solution Service (GSS) server'},
'initial_access_broker': {'entry_point': 'Compromised maintenance and '
'operations employee’s account'},
'investigation_status': 'Completed (initial investigation in July)',
'lessons_learned': 'The breach highlights the risks of unpatched security '
'flaws in critical government infrastructure.',
'post_incident_analysis': {'corrective_actions': 'Enhance vulnerability '
'management protocols',
'root_causes': 'Exploited unpatched vulnerability '
'in VPN product, compromised '
'employee account'},
'recommendations': 'Enhance vulnerability management protocols, ensure timely '
'patching of known vulnerabilities.',
'references': [{'source': 'Cyber Incident Description'}],
'response': {'containment_measures': 'Blocked external access to the affected '
'server, suspended the compromised '
'employee account',
'incident_response_plan_activated': 'Yes',
'remediation_measures': 'Enhance vulnerability management '
'protocols'},
'title': 'Japan’s Digital Agency Data Breach Impacting 240,000 Individuals',
'type': 'Data Breach',
'vulnerability_exploited': 'Unpatched vulnerability in unnamed VPN product'}