Japan’s Digital Agency has disclosed a data breach that exposed approximately 246,000 rows of personal information belonging to government employees, public officials, and associated businesses. Attackers gained initial access by exploiting a known vulnerability — not a zero-day — in a VPN device connected to the Government Solution Service (GSS), a shared IT platform used across Japanese government ministries. The breach was first detected on July 9th, but the agency delayed public disclosure until September while it worked to trace the intrusion path and determine exactly which records were reached.
The exposed data covers individuals who use the GSS system, including career civil servants, ministry staff, contractors, and third-party organizations that interact with the system. The agency told the public that the incident was isolated to the affected system — no other government platforms were compromised, and government service availability was not disrupted. Japan’s Personal Information Protection Commission was notified on July 15th. The agency has not named the VPN product or the specific vulnerability, but said the flaw carried a medium severity rating. The delay between discovery and public disclosure underscores how long complex government breach investigations can take even when an attacker’s entry point is confirmed relatively quickly.