VULNpocalypse
Breaches and incidentsBriefChecked against a primary source

Japan Digital Agency (Government Solution Service): VPN flaw exposes about 246,000 personal records

The Digital Agency said a third party breached the shared government IT platform GSS “by exploiting a vulnerability in a network connection device (VPN)”.

Disclosed

What happened

  • The Digital Agency said a third party breached the shared government IT platform GSS “by exploiting a vulnerability in a network connection device (VPN)”. About 246,000 records may have leaked: about 189,000 relate to staff of GSS user organisations and public officers, about 57,000 to businesses and individuals; mostly names, email addresses and phone numbers. No My Number, financial or pension data.
  • Root cause: VPN device vulnerability (vendor and CVE not named by the agency; Security Affairs reports it was not a zero-day), followed by use of a maintenance and operation account. Mass file access was spotted on 25 Jun; the breach was confirmed on 9 Jul; public disclosure came on 11 Sep.
  • Attacker: not identified.
  • Response: account suspended, device’s external communication cut, VPN patch applied, vulnerability-management review; affected people being notified.

Sources

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.