Around 246,000 rows of personal data on Japanese government staff and their partners are now in the hands of an unknown intruder, and the way in was a VPN flaw the country’s Digital Agency already knew about. The agency had started work on a fix. The attacker got there first.
According to officials, the trouble surfaced on June 25, when the agency spotted large-scale file access from the account of a maintenance and operations staff member on its Government Solution Service, known as GSS. On July 9 investigators confirmed that a third party had used a weakness in a network-connected VPN device to break in. The same day the agency suspended the account and cut the compromised equipment off from outside communication. It notified Japan’s Personal Information Protection Commission on July 15 and told the public in September, saying it had taken time to map the attack route and work out who was affected.
What was taken
The files hold about 236,000 names, 231,000 email addresses, 94,000 phone numbers and 1,000 physical addresses, with some records overlapping. Roughly 189,000 entries cover staff at government bodies that use GSS and other public-sector workers. The remaining 57,000 or so relate to companies and individuals who worked with those bodies, among them partner-firm employees, sole proprietors and attendees of ministry web meetings.
Most of it came from the registration forms people fill in to get access, so the phone numbers and addresses mostly point to ministry buildings or official work lines, not homes. The 246,000 figure counts every record the agency cannot confirm as safe, which means the true total could be lower.
My Number IDs, bank details and pension numbers were not exposed. Nor was any data on the general public. The agency says no other system was breached and that government services ran normally throughout.
A known flaw, a medium score
The agency declines to name the VPN product or the vulnerability, citing security concerns. It did say the flaw carried a medium severity rating and was not a zero-day. It was public before the attack. The agency says it moved faster than standard practice for a medium-rated issue would require, and still lost the race.
Analysts note why that matters. A severity score rates a flaw on its own terms and ignores where the device sits. A VPN appliance guarding a central government platform draws far more attention than one on a small office network. The agency now says it will weigh real-world risk and the importance of the system when it ranks patches, and will rework how outside users connect to GSS.
GSS runs on a zero trust architecture, and the agency conceded that the design did not stop this. It also did not say when the attacker first got in, since June 25 only marks detection, or how the intruder moved from the VPN device to the maintenance account. No group has claimed the attack. The agency has applied the patch, changed credentials on the affected accounts and reports no new suspicious traffic since.
No misuse of the data has been seen, but about 231,000 work email addresses tied to names are good raw material for targeted phishing aimed at officials and contractors. The agency urges recipients not to open links or attachments in unsolicited messages and not to share passwords or card details, and says it never asks for such information by email or phone. Affected people will be contacted directly, and a toll-free support line is open.
Sources
- Japan's Digital Agency says VPN flaw exposed 246,000 personnel records
- Japan's Digital Agency Confirms Data Breach via Known VPN Flaw
