Japan’s Digital Agency Breach Exposes 240,000+ Users’ Personal Records to Hackers
Attackers exploited a patched VPN appliance flaw to breach Japan's Digital Agency shared government platform, exposing about 246,000 personal records.
Japan's Digital Agency disclosed on September 11 that attackers exploited a VPN appliance vulnerability to access the Government Solution Service (GSS), a shared IT platform across ministries, exposing roughly 246,000 personal records. The attacker was active since late May using a maintenance staffer's credentials, with suspicious activity detected June 25 and containment on July 9. Exposed data covers about 189,000 employees/public officials and 57,000 contractors; no My Number, bank, or pension data was included. The VPN flaw was medium severity with a patch already available, and the 78-day detection-to-disclosure gap has drawn scrutiny.
- Patched medium-severity VPN flaw enabled intrusion into shared government platform
- ~246,000 records exposed: 189,000 officials, 57,000 contractors
- Attacker active since late May using staff credentials; contained July 9
- No My Number or bank data affected; no confirmed misuse so far
- 78-day gap between detection and public disclosure raises patch-management scrutiny
From the original article
2 min read at cybersecuritynews.com
Japan’s Digital Agency has confirmed a significant data breach affecting the Government Solution Service (GSS), a shared IT platform used across multiple ministries and government bodies, after attackers exploited a vulnerability in a VPN appliance to gain unauthorized access to internal servers. The agency disclosed on September 11 that approximately 246,000 personal records may have […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.