Japan’s Digital Agency says a breach of its Government Solution Service may have exposed personal information tied to about 246,000 records for government employees, officials, and related users. The agency says an attacker exploited a vulnerability in a VPN device to gain initial access and then used a maintenance staff account for large-scale file access. The flaw was described as medium severity and not a zero-day, but the vendor, product, and CVE were not disclosed.
Why it matters: This affects government personnel and people connected to a shared public-sector IT platform, creating immediate impersonation and phishing risk even if misuse has not yet been confirmed. Affected users should treat unsolicited messages and calls as suspicious, while defenders should identify the VPN product involved, confirm patch status, review admin and contractor accounts, and hunt for follow-on access.
Ionut Arghire
2026.09.15
99% relevant
This article is the same underlying event: Japan’s Digital Agency disclosure that attackers exploited a VPN flaw, used an employee account, and accessed roughly 246,000 records in the Government Solution Service environment.
Bill Toulas
2026.09.14
100% relevant
This article establishes a new tracked story by identifying a specific breach event at Japan’s Digital Agency, including the attack vector, affected system, exposed data categories, and estimated record count.
← Back to all stories