GoKawiilJapan's Digital Agency confirms VPN breach exposed 246,000 employee records
Japan's Digital Agency disclosed that an attacker exploited a known, medium-severity vulnerability in a VPN device used by its Government Solution Service to access internal systems. The breach, detected after unusual account activity on June 25 and confirmed on July 9, may have exposed roughly 246,000 rows of data including names, emails, phone numbers and some addresses belonging to government staff and affiliated businesses.
GoKawiil's interpretation of the reporting above, not reported fact.
The breach highlights how unpatched VPN appliances remain a persistent entry point for attackers targeting government networks, even when the flaw isn't a zero-day. While no sensitive identifiers like My Number IDs or banking details were exposed, the leaked contact information raises the risk of targeted phishing and impersonation against public officials.
- A known VPN vulnerability, not a zero-day, allowed unauthorized access to Japan's Government Solution Service.
- Around 246,000 records were exposed, including names, emails, phone numbers, and some physical addresses.
- No misuse has been detected yet, but the agency warns of phishing risks and reminds users it never requests passwords via email or phone.
Source: bleepingcomputer.com, 2026-09-14
Published there as: “Japan's Digital Agency says VPN flaw exposed 246,000 personnel records”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.