Full Breakdown
Japan’s Digital Agency Reports Unauthorized Access Affecting 246,000 Personal Records
By Drooid · · How we work
Breach Overview
Japan’s Digital Agency announced that an external party gained unauthorized access to the Government Solution Service (GSS), a shared IT platform used by ministries and agencies. The breach potentially exposed personal information from about 246,000 records belonging to civil servants and private-sector contractors. The agency has confirmed that no misuse of the data has been identified and that identifiers such as My Number and bank-account details were not included.
Timeline of Detection and Investigation
- June 25 – Suspicious activity was detected from a maintenance-administrator account on the GSS network.
- July 9 – An investigation revealed that the same account had been repeatedly accessed by an external actor since around late May, exploiting a vulnerability in a virtual private network (Virtual Private Network (VPN)) device.
- September 11, 2026 – The Digital Agency publicly disclosed the breach, describing the steps taken to disable the compromised account and to restrict communications between the affected equipment and external networks.
Scope of Exposed Data
The agency’s statement broke down the affected records as follows: roughly 189,000 pertain to government employees and staff of institutions using GSS, while about 57,000 involve companies and individuals engaged in government business. The data types potentially exposed include approximately 236,000 names, 231,000 email addresses, 94,000 telephone numbers and 1,000 physical addresses. The agency emphasized that the breach did not involve personal data of the general public.
Official Response
He pledged that the agency will continue its investigation, assess the full scope of exposure, notify affected parties and implement measures to prevent a recurrence.
Verbatim Quotes
- “We take it seriously that the incident occurred despite our operations under multi-layered security measures and a 24-hour-a-day, 365-day-a-year surveillance system,” — Chief Cabinet Secretary Minoru Kihara
The Digital Agency’s disclosure comes amid a broader rise in cyber incidents in Japan, with the National Police Agency reporting 123 ransomware attacks in the first half of 2026—the highest six-month total since tracking began.
