TOKYO, September 19 — Japan’s Digital Agency has disclosed a data breach affecting the personal information of approximately 240,000 individuals, according to the agency’s own account of the incident, with attackers compromising more than 246,000 records. The breach was discovered in late June, after hackers accessed files from the agency’s Government Solution Service (GSS) using a maintenance and operations employee’s account. In July, the investigation determined that a vulnerability in a VPN product had been exploited to gain access to the system.
The compromised records contained names (approximately 236,000), addresses (~1,000), email addresses (~231,000), and phone numbers (~94,000). The information belongs to users, public officials, administrative staff, and businesses and individuals working with GSS.
The leaked information had been provided by each individual when applying to use GSS, and most of the addresses and phone numbers are associated with the individuals’ workplace — namely a government building or an office — the agency explains in an accompanying FAQ. Other personal information, such as individual identification numbers and financial account information, was not affected.
Response and Remediation
Japan’s Digital Agency blocked external access to the affected server and suspended the employee account used in the attack immediately after confirming the exploitation. While it did not name the exploited VPN product, it said it would strengthen vulnerability management. The agency said no other systems were compromised in the attack, and no information of the general public was compromised.
The disclosure places the incident in a broader pattern of recent technology-sector breaches.
Related reporting cited by the source includes the Gyazo maker Helpfeel, which said an attacker exploited a vulnerability in its image upload server to gain unauthorized access; Revolut, which allegedly fed customer information to hackers impersonating an Italian government agency for five months; Spanish regulators, who said an AI agent chained together a successful login, vulnerability discovery, and access to personal data in a potential milestone for autonomous attacks; US, UK, and Dutch government agencies, which published a report detailing malware, with the FBI describing the abuse of Telegram for command-and-control; a June 2026 incident in which hackers accessed files containing patients’ names, contact information, diagnosis details, and health insurance information; a hacker who claims to have stolen 7.5 million customer records after breaching a company’s systems; a company that unintentionally disclosed users’ information to a third party impersonating a government agency; and stolen credentials used in a multi-month campaign to access subscriber personal data and billing records.
For India and the wider Asian market, the incident underscores the growing pressure on government digital services to secure the third-party tools and maintenance accounts that sit behind public-facing platforms. The Digital Agency’s disclosure is likely to sharpen scrutiny of VPN and remote-access products used across public-sector IT in the region.
