Digital Agency (Japon)

ModerateConfirmedPublic sectorSeptember 11, 2026

Japan's Digital Agency announced on 2026-09-11 that a third party had exploited a VPN device vulnerability to breach its Government Solution Service (GSS), a shared platform used by government bodies. Unauthorized access was detected on 2026-06-25 via a maintenance account that accessed a large number of files, and the intrusion was confirmed on 2026-07-09, when the account was disabled. Around 246,000 personal records may have been exposed, including names, email addresses, phone numbers and postal addresses of government staff and partner-organization personnel, but not My Number IDs, bank account details or pension numbers. No misuse of the data had been confirmed as of the announcement.

The exposed contact details (names, emails, phone numbers, addresses) could be used to target government staff and contractors with phishing or professional impersonation.

Disclosed on: September 11, 2026
Incident dated: June 25, 2026
Accounts affected: 246,000
Sector: Public sector
Country: Japan
Cause: Misconfigured database

Exposed data

Email address
Full name
Phone number
Postal address
Employment data

You are only affected if you had an account or an order with this organisation.

What you can do

Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

Sources

Entry built from the cited sources after a corroboration check, then reviewed before publication. Spotted an error, or have a correction? Write to us and the entry will be fixed. Contact