In 2026, Japan’s Digital Agency experienced an unauthorized access incident involving its Government Solution Service (GSS). Attackers exploited a known vulnerability in a VPN device and accessed a large number of files using a compromised maintenance account.
Approximately 246,000 records containing personal information may have been exposed, including names, email addresses, and phone numbers. However, no information on the general public, My Number, bank accounts, or pension numbers was involved.
The Agency has blocked the affected systems and is strengthening its vulnerability management and security measures.