In mid-2026, hackers exploited a publicly disclosed vulnerability in an unnamed VPN product used by Japan's Digital Agency to gain unauthorized access to the Government Solution Service (GSS). Using a maintenance and operations employee's account, attackers accessed over 246,000 records containing personal data including names (~236,000), email addresses (~231,000), phone numbers (~94,000), and workplace addresses (~1,000). The breach was detected in late June 2026, and the agency responded by blocking external access to the compromised server and suspending the employee account involved. The vulnerability exploited had been publicly known before the incident. The breach did not affect individual identification numbers, financial account information, or data of the general public, and no other systems were compromised.

The breach exposed personal information of approximately 240,000 individuals associated with the Government Solution Service, including public officials, administrative staff, businesses, and users. The compromised data included names, email addresses, phone numbers, and workplace addresses, potentially increasing risks of targeted phishing or social engineering attacks. However, sensitive data such as individual identification numbers and financial information were not affected. The incident was limited to one system and did not impact the general public's information.

Japan's Digital Agency has blocked external access to the affected server and suspended the compromised employee account. The agency plans to strengthen vulnerability management practices. Since the exploited VPN vulnerability was publicly disclosed prior to the attack, organizations using the same VPN product should verify patch status and apply official fixes if available. Users and administrators should monitor for any suspicious activity related to the compromised data. Patch status for the VPN product is not confirmed in the provided data; check the vendor advisory for current remediation guidance.