InfoSecBulletin Cybersecurity for mankind
Japan’s Digital Agency found a data leak that may have exposed about 246,000 records with personal information of government workers. The agency explains that the attacker got in by taking advantage of a weak spot in a VPN device used by the Government Solution Service (GSS).
An investigation began on June 25 when the agency found a big file access from a maintenance and operations worker’s account. “On July 9th, it was discovered that a third party had used a vulnerability in a network-connected device (VPN) to gain access to the system and gain unauthorized access,” reads the announcement.
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
“On the same day, we suspended the account of the maintenance and operations personnel in question, cut off communication between the compromised equipment and the outside world, and prevented further unauthorized access.”
It is not clear which VPN product was affected or what weakness was used in the breach. The Japanese agency said in a separate Q&A that the problem had a medium severity rating and was not a zero-day.
The investigation revealed that the following data may have been exposed:
236,000 names
231,000 email addresses
94,000 telephone numbers
1,000 physical addresses
People whose information was exposed include government workers, public leaders, and businesses or individuals connected to the GSS system.
The event did not reveal personal data of the public. The information that might be at risk does not include My Number IDs, bank account info, or pension numbers.
The agency has not found any real misuse of the affected information, but it still warned about the high risk of impersonation and phishing. It told people not to open links or attachments in unexpected messages. The Digital Agency reminded everyone that it will never ask for passwords or credit card details by email or phone.
Affected people will be contacted directly, and the agency also created a special support line.
The agency told Japan’s Personal Information Protection Commission on July 15. They explained that the delay in informing the public was because it was complicated to figure out how the intrusion happened, what information might be affected, and who was impacted.
The agency says the effect was only on the affected system, and there was no confirmed unauthorized access, data leaks, or similar breaches on other systems. It also mentioned that the incident and response actions didn’t disrupt government services.
