Japan Digital Agency Reports Potential Leak of 246,000 Records After Cyberattack

The Japan Digital Agency reported a cyberattack on the government network that could have resulted in the theft of personal information from about 246,000 government workers, contractors, and other individuals working for the government. The Japan Digital Agency reported on September 11 that the investigation of its Government Solution Service (GSS) discovered that a third-party hacker attacked a virtual private network device to gain access to personal information in a file. The Japan Digital Agency detected the attack on June 25 when a maintenance and operation account was used to access thousands of files on its servers.

VPN Vulnerability Enabled Unauthorised Access To Government Files

It was discovered on July 9 that the entry was made by a third party due to a vulnerability in the VPN. The maintenance account was deactivated on that same day, and the communication between the network devices and external systems was cut off to prevent any further access. Further investigation with the help of external security professionals revealed that some files might have been stolen from the network.

The compromised data is of people who are employed by the government ministries and agencies using GSS, public servants who were involved in these organisations, as well as firms and individuals who were involved with the operations of GSS organisations. There are about 189,000 records that involve employees of organisations that are members of GSS and public servants who were involved in the activities of GSS organisations. In addition, there are about 57,000 records that involve firms and individuals.

According to the Digital Agency of Japan, there were no My Number identifiers, bank account numbers, or pension numbers in the leaked information. The agency has assured that none of the personal information of the common citizens had been leaked. Misuse of any of the compromised personal data has not yet been discovered, said the agency. The authorities are trying to find out who the individuals are whose personal data has been compromised, and then contacting them personally.

It was stated that the contact information may be used to impersonate individuals or perform phishing attacks. The organisation urged victims to avoid opening links or attachments and providing passwords, authentication codes, and credit card information in reply to such e-mails, phone calls, or messages that purportedly come from any governmental institutions.

Security incidents involving compromised access and infrastructure have remained a concern outside government systems as well. Crypto losses hit $1 billion (roughly Rs. 9,555 crore) during the first half of 2026 as the sector witnessed its highest tally of hacks within six months, claims on-chain security platform Blockaid. The two blockchain networks, Ethereum and Solana, experienced the biggest impact from attacks on their systems.