Japan’s Digital Agency reports data breach affecting government employees

Bleeping Computer reports that Japan's Digital Agency has disclosed a significant data breach that may have compromised the personal information of approximately 246,000 government employees.

The breach occurred when an attacker exploited a vulnerability in a VPN device used by the Government Solution Service (GSS). The Digital Agency detected unusual file access on June 25, initiating an investigation that confirmed unauthorized access on July 9. The agency has since suspended the compromised account and isolated the affected equipment. While the specific VPN product and vulnerability remain undisclosed, the agency stated the issue had medium severity and was not a zero-day exploit. Potentially exposed data includes names, email addresses, telephone numbers, and physical addresses of government employees, public officials, and associated individuals or businesses. The breach did not affect the general public's data, nor did it expose My Number identification, bank account, or pension details.

Although no misuse of the compromised data has been detected, the agency warned of increased risks of impersonation and phishing. Affected individuals will be contacted directly, and a support line has been established. The agency clarified that the delay in public disclosure was due to the complexity of the investigation.

Source: Bleeping Computer