Japan's Digital Agency says VPN flaw exposed 246,000 personnel records
Attackers exploited a VPN device vulnerability to breach Japan's Digital Agency, potentially exposing 246,000 records of government employees and officials.
Japan's Digital Agency disclosed that a third party exploited a medium-severity, non-zero-day vulnerability in a VPN device used by the Government Solution Service (GSS) to gain unauthorized access. Around 246,000 record rows were potentially exposed, including 236,000 names, 231,000 email addresses, 94,000 phone numbers, and 1,000 physical addresses of government employees and associated businesses. No My Number IDs, bank account details, or pension numbers were exposed, and no misuse of the data has been detected so far. The agency suspended the compromised staff account on July 9 and notified Japan's Personal Information Protection Commission on July 15.
- VPN device flaw gave attackers access to Japan's Government Solution Service system
- ~246,000 rows exposed: names, emails, phone numbers, addresses of officials
- No My Number, bank, or pension data leaked; no misuse detected yet
- Flaw rated medium severity, not a zero-day; VPN product undisclosed
From the original article
2 min read at bleepingcomputer.com
Japan's Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.