Japan Digital Agency Says VPN Flaw May Have Exposed 246,000 Personnel Records
Summary
Japan’s Digital Agency says attackers exploited a VPN vulnerability to access a system, potentially exposing 246,000 record rows. The agency reported no confirmed misuse and warned affected people about phishing and impersonation.
Key points
- The agency says attackers exploited a vulnerability in a VPN device used by the Government Solution Service (GSS); the product and vulnerability are unspecified.
- The investigation began after large-scale file access was detected from a maintenance and operations staff account.
- Potentially exposed information included names, email addresses, phone numbers, and some physical addresses belonging to government employees, public officials, and others using GSS.
- The agency said My Number IDs, bank-account details, and pension numbers were not exposed, and the incident did not involve the general public’s personal data.
- No actual misuse has been detected; the agency warned of phishing and impersonation risks and arranged direct contact and support for affected individuals.
- The agency suspended the account, isolated the affected equipment, and said it found no impact on other systems or government service availability.
Article Details
- Victim Organization
- Japan’s Digital Agency
- Incident Type
- Unauthorized access through exploitation of a vulnerability in a VPN device used by the Government Solution Service; personal data may have been exposed.
- Data Types Exposed
- Names
- Email addresses
- Telephone numbers
- Physical addresses
- Affected Records
- Approximately 246,000 record rows may have been exposed. The agency reported about 236,000 names, 231,000 email addresses, 94,000 telephone numbers, and 1,000 physical addresses.
- Operational Impact
- The agency said the impact was limited to the affected system and government service availability was not affected. It reported no confirmed misuse of the information and no confirmed impact on other systems.
- Claim Status
- confirmed