Japan says 246000 personal data records may have leaked in government network breach

Japan’s Digital Agency said on Friday that personal information contained in 246,000 records may have been exposed after an unauthorized intrusion into a government network.

The incident involved the Government Solution Service (GSS), a shared information technology environment used by Japanese government agencies, according to a statement.

The agency said it detected unauthorized access to numerous files on June 25 through an account assigned to a worker responsible for maintenance and operations. It later determined that an external party had exploited a vulnerability in a virtual private network (VPN) device to gain access to the system.

According to the agency, the intrusion was identified during an investigation completed on July 9. Authorities disabled the affected account and restricted communications between the relevant equipment and external networks.

The potentially affected records include 189,000 involving government employees and other personnel working for organizations that use the GSS, as well as approximately 57,000 related to companies and individuals engaged in government business.

The exposed information may include 236,000 names, 231,000 email addresses, 94,000 telephone numbers and 1,000 addresses.

The agency said the information did not include personal data held by the government on members of the general public, and that it would notify individuals and organizations identified as potentially affected.

The agency said it was continuing to investigate the incident, assess the scope of the exposure and take measures to prevent a recurrence.