57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
Non-Zero-Day VPN Flaw Left Japan ‘s Government Shared Network Platform Exposed: 246,000 Records at Risk
Japan's Digital Agency says attackers exploited a patchable VPN flaw to access a government shared platform, exposing records of ~246,000 employees across 23 ministries.
Japan's Digital Agency disclosed that attackers exploited a medium-severity, already-patchable vulnerability in a VPN device to access the Government Solution Service (GSS), potentially leaking personal data of roughly 246,000 government employees, officials, and contractors across 23 ministries. The intrusion was detected on June 25 and confirmed as VPN exploitation on July 9, with public disclosure 78 days after detection. Exposed data includes about 236,000 names, 231,000 email addresses, 94,000 phone numbers, and 1,000 physical addresses; no My Number, bank account, or pension numbers were included. The compromised maintenance staff account was suspended and the compromised hardware isolated, but the VPN product and flaw were not disclosed.
72
Mathspace breach exposes data on over a million students and parents
Mathspace confirmed attackers exploited an unpatched Metabase SQL injection flaw to steal personal data of 1,079,819 students, parents, and staff in Australia and New Zealand.
Attackers accessed Mathspace's self-hosted Metabase reporting system without legitimate login, with unauthorized access dating back to 10 August 2026 and data downloaded on 27 August. Exposed data includes names, usernames, email addresses, country, and account metadata; no passwords, academic records, SSO tokens, or API credentials were taken. Framework, Tally, and Kilo Code disclosed similar breaches via the same Metabase SQL injection flaw in August 2026.
72
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57
57