Reported by 4 outlets

Timeline

1. original reporting

   Japan's Digital Agency said about 246,000 sets of personal information, including the names and addresses of government employees, may have

   www.japantimes.co.jp · 32d ago · September 11th, 2026

   Japan's Digital Agency said about 246,000 sets of personal information, including the names and addresses of government employees, may have

   via Mastodon https://www.japantimes.co.jp/news/2026/09/11/japan/digital-agency-information-leakage/?utm_medium=Social&utm_source=mastodon

2. update from bleepingcomputer.com

   Japan's Digital Agency says VPN flaw exposed 246,000 personnel records

   bleepingcomputer.com · 29d ago · September 14th, 2026

   Japan’s Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees. The agency says that the attacker gained initial access by exploiting a vulnerability in a VPN device used by the Government Solution Service (GSS). An investigation started on June 25, after the agency detected a large-scale file access from the account of a maintenance and operations staff member. “On July 9th, it was discovered that a third party had used a vulnerability in a network-connected device (VPN) to gain access to the system and gain unauthorized access,” reads the announcement . “On the same day, we suspended the account of the maintenance and operations personnel in question, cut off communication between the compromised equipment and the outside world, and prevented further unauthorized access.” It is unclear what VPN product was affected or the vulnerability exploited in the breach. However, the Japanese agency said in a separate Q&A that the issue had a medium severity rating and was not a zero-day. The investigation revealed that the following data may have been exposed: 236,000 names 231,000 email addresses 94,000 telephone numbers 1,000 physical addresses Exposed individuals include government employees, public officials, and associated businesses and individuals who use the GSS system. However, the incident did not expose personal data of the general public, and the potentially compromised informati

3. update from www.bleepingcomputer.com

   Japan Digital Agency VPN flaw exposes 246,000 government employee records

   www.bleepingcomputer.com · 29d ago · September 14th, 2026

   246,000 personal records exposed via VPN flaw -- and the Japanese digital agency managing the government's digital transformation is受影响

   via Mastodon https://www.bleepingcomputer.com/news/security/japans-digital-agency-says-vpn-flaw-exposed-246-000-personnel-records/

4. mentioned by www.bleepingcomputer.com

   🤖 Japan's Digital Agency disclosed a breach that may have exposed ~246,000 personnel records. Attackers exploited a flaw in a VPN appliance

   www.bleepingcomputer.com · 29d ago · September 15th, 2026

5. update from securityweek.com

   240,000 Hit by Data Breach at Japan’s Digital Agency

   securityweek.com · 28d ago · September 15th, 2026

   The incident, it says , was discovered in late June, after the hackers accessed files from its Government Solution Service (GSS) using a maintenance and operations employee’s account. The compromised information, it says, belongs to users, public officials, administrative staff, and businesses and individuals working with GSS. The leaked information had been provided by every individual when applying to use GSS, and most of the addresses and phone numbers are associated with the individuals’ workplace, namely a government building or an office, the agency explains in an accompanying FAQ . Other personal information, such as individual identification numbers and financial account information, was not affected. Japan’s Digital Agency blocked external access to the affected server and suspended the employee account used in the attack immediately after confirming the exploitation. While it did not name the exploited VPN product, it said it would strengthen vulnerability management, as the targeted vulnerability ha

6. update from beyondmachines.net

   Japan Digital Agency VPN Breach Potentially Exposes 246,000 Personnel Records Japan's Digital Agency disclosed a data breach after an attack

   beyondmachines.net · 28d ago · September 15th, 2026

   Japan Digital Agency VPN Breach Potentially Exposes 246,000 Personnel Records Japan's Digital Agency disclosed a data breach after an attack

   via Mastodon https://beyondmachines.net/event_details/japan-digital-agency-vpn-breach-potentially-exposes-246000-personnel-records-l-u-u-m-r/gD2P6Ple2L