Published: September 11, 2026 (Official Announcement by the Digital Agency of Japan) Scope: Approximately 246,000 records of government employees and contractors
Overview
Japan’s Digital Agency announced that its Government Solution Service (GSS) experienced unauthorized access due to a vulnerability in a VPN device. As a result, files containing personal information of government personnel may have been leaked externally.
No general citizen data was involved, but the incident affects a large number of:
- Government employees
- Public officials
- Contractors
- Individuals involved in administrative operations
This makes it one of the most serious government‑related security incidents in Japan’s digital transformation efforts.
1. Timeline of the Incident
June 25, 2024
Unusual access to a large number of files was detected using a maintenance operator’s account.
July 9, 2024
Investigation revealed that a third party had exploited a vulnerability in a VPN device to infiltrate the system and perform unauthorized access.
The compromised account was immediately suspended, and external communication from the affected device was blocked.
2024–2026
A detailed investigation with external security experts confirmed that personal information may have been leaked outside the system.
2. Personal Information Potentially Leaked (Approx. 246,000 Records)
Affected Individuals
- Government ministry employees
- Public officials
- Contractors and outsourced personnel
- Individuals involved in administrative tasks
※ No general citizen data was included.
Types of Information
(Counts include duplicates)
- Names: 236,000
- Email addresses: 231,000
- Phone numbers: 94,000
- Addresses: 1,000
- Other work‑related information
Breakdown
- Government personnel: 189,000
- Contractors / individuals: 57,000
3. Current Findings
- No secondary misuse has been confirmed at this time
- However, phishing and impersonation attempts remain possible
- The Digital Agency has begun notifying affected individuals
- No passwords, financial data, or My Number (national ID) information were included
4. Cause and Structural Issues
Cause
- Exploited VPN vulnerability
- Misuse of a maintenance operator account
- Insufficient monitoring of external connections
Structural Issues
- Weak access control for contractor accounts
- Insufficient security auditing
- Overreliance on outsourced operations
- Concerns about the security foundation of Japan’s government DX infrastructure
5. Government Response
- Individual notifications to affected personnel
- Public warning against suspicious emails and SMS
- Collaboration with external cybersecurity experts
- Review of vulnerability management procedures
- Strengthening monitoring of external connections
- Implementation of long‑term preventive measures
Conclusion
This incident represents a major breach within Japan’s administrative digital infrastructure, with approximately 246,000 personnel records potentially exposed.
Although no citizen data was involved, the breach raises serious concerns about the security of Japan’s government digital transformation (DX), especially given the central role of GSS in administrative operations.
コメント