---
title: "Data breach at Digital Agency (Japon)"
description: "Japan's Digital Agency announced on 2026-09-11 that a third party had exploited a VPN device vulnerability to breach its Government Solution Service (GSS), a shared platform used by government bodies. Unauthorized access was detected on 2026-06-25 via a maintenance account that accessed a large numb"
canonical: https://inyourgeek.com/en/fuites-de-donnees/2026-09-11-digital-agency-japon
type: fuite-de-donnees
author: "Sébastien Soulier"
publisher: "InYourGeek"
language: en
datePublished: 2026-09-11
dateModified: 2026-09-11
---
# Digital Agency (Japon)

Data breach — Moderate

Japan's Digital Agency announced on 2026-09-11 that a third party had exploited a VPN device vulnerability to breach its Government Solution Service (GSS), a shared platform used by government bodies. Unauthorized access was detected on 2026-06-25 via a maintenance account that accessed a large number of files, and the intrusion was confirmed on 2026-07-09, when the account was disabled. Around 246,000 personal records may have been exposed, including names, email addresses, phone numbers and postal addresses of government staff and partner-organization personnel, but not My Number IDs, bank account details or pension numbers. No misuse of the data had been confirmed as of the announcement.

The exposed contact details (names, emails, phone numbers, addresses) could be used to target government staff and contractors with phishing or professional impersonation.

| Fact | Value |
| --- | --- |
| Disclosed on | September 11, 2026 |
| Incident dated | June 25, 2026 |
| Accounts affected | 246,000 |
| Sector | Public sector |
| Country | Japan |
| Cause | Misconfigured database |
| Severity | Moderate |
| Status | Confirmed |

## Exposed data

- Email address
- Full name
- Phone number
- Postal address
- Employment data

## What you can do

- Expect phishing attempts quoting your name and this company. A message that knows your details is not legitimate for that reason.
- You can ask the organisation exactly what was exposed about you (right of access), and complain to the DPA if no answer comes within a month.

## Sources

- [Personal Info Possibly Compromised at Japan’s Digital Agency](https://databreaches.net/2026/09/11/personal-info-possibly-compromised-at-japans-digital-agency/) — DataBreaches.net
- [Japan government system hit by cyberattack; 246,000 personal records may have been leaked](https://www.thestar.com.my/aseanplus/aseanplus-news/2026/09/11/japan-government-system-hit-by-cyberattack-246000-personal-records-may-have-been-leaked) — The Star
- [Japan's Digital Agency Hit by Unauthorized Access to Servers](https://www.insurancejournal.com/news/international/2026/09/11/884766.htm) — Insurance Journal
- [デジタル庁に不正アクセス、個人情報24.6万件漏えいか 各府省庁の職員情報など](https://www.itmedia.co.jp/news/article/2609/11/2000001406/) — ITmedia NEWS
- [個人情報２４．６万人分漏えいか＝デジタル庁運用システムに不正アクセス](https://www.jiji.com/jc/article?k=2026091100453&g=pol) — Jiji.com
- [個人情報２４．６万人分漏えいか＝デジタル庁運用システムに不正アクセス](https://www.nippon.com/ja/news/yjj2026091100453/) — nippon.com
- [デジタル庁 GSS(ガバメントソリューションサービス)に不正アクセス、VPN脆弱性を悪用](https://rocket-boys.co.jp/security-measures-lab/digital-agency-privacy-data-incident/) — セキュリティ対策Lab
- [Japan's Digital Agency says VPN flaw exposed 246,000 personnel records](https://www.bleepingcomputer.com/news/security/japans-digital-agency-says-vpn-flaw-exposed-246-000-personnel-records/) — Bleeping Computer

_Entry built from the cited sources after a corroboration check, then reviewed before publication._

---

Equivalent HTML page : https://inyourgeek.com/en/fuites-de-donnees/2026-09-11-digital-agency-japon
Published by InYourGeek — https://inyourgeek.com/en/a-propos
Method and safeguards : https://inyourgeek.com/en/methode
Full register : https://inyourgeek.com/en/fuites-de-donnees