2026 Japan Digital Agency GSS — VPN flaw; ~246,000 personnel-related records possibly leaked
Data compromised
Approx. 246,000 personal-information cases possibly leaked — ~236k names, ~231k emails, ~94k phones, ~1k addresses for GSS agency staff/officials and related contractors; no My Number, bank accounts, or pension numbers; general public not included
Technical writeup
Verified Japan Digital Agency disclosure — September 11, 2026. GSS large-scale file access detected June 25 via maintenance/operations account; July 9 confirmation that a third party exploited a VPN network device vulnerability (known, medium severity, not zero-day per agency Q&A); account stopped and communications cut same day. ~246,000 personal-information cases for GSS-using agency staff (~189k) and related contractors/individuals (~57k) may have leaked. PPC notified July 15. No confirmed secondary misuse at announcement. recordsAffected 246000; companyConfirmed true.
Root cause
Known medium-severity VPN device vulnerability on Government Solution Service (GSS) exploited for unauthorized access; detected via large-scale file access using a maintenance account