Japan Digital Agency (Government Solution Service) data breach
Was I affected?
Japan Digital Agency (Government Solution Service) confirmed a breach involving up to 246,000 records (duplicates possible), exposing names, email addresses, phone numbers and addresses. You may be affected if you work, or worked, for a Japanese ministry or agency that uses the Government Solution Service, or did business with one, and the Digital Agency contacts you.
| Announced | Sep 11, 2026 |
|---|---|
| When it happened | From late May 2026; detected June 25, 2026 |
| Country | Japan |
| Records exposed (may include duplicates) | 246,000 |
| Data exposed | Names, Email addresses, Phone numbers and Addresses |
| Status | Confirmed by the company or a regulator filing |
What happened
Japan's Digital Agency said on September 11, 2026 that files on the Government Solution Service (GSS), the shared IT environment it runs for ministries and agencies, may have leaked after an outsider broke in through a vulnerability in a VPN device. It detected mass file access from a maintenance staff account on June 25 and confirmed the intrusion on July 9; Kyodo reports the access had been going on since around late May. About 246,000 records of personal information may have leaked, covering staff of the agencies using GSS and businesses and individuals who worked with them; the fields counted were names (about 236,000), email addresses (about 231,000), phone numbers (about 94,000) and addresses (about 1,000), with overlap. The agency says no data on the general public, My Number, bank account or pension numbers was included.
What should I do?
- Watch for phishing emails, texts and calls that pretend to be from the Digital Agency or your ministry; the agency says it never asks for passwords or card details by email or phone.
- Don't open links or attachments in unexpected work-related messages, even if they use your real name and title.
- Use the dedicated Digital Agency hotline listed on its official notice if you have questions.
Check the other services you use →
Sources
- ガバメントソリューションサービスへの不正アクセスによる職員等の個人情報の漏えいの可能性について (Possible leak of staff personal data after unauthorized access to the Government Solution Service) · Digital Agency (in Japanese) · official
- 政府ネットに不正アクセス ２４万件超漏えいか · Kyodo News (via Kumamoto Nichinichi Shimbun) (in Japanese) · news
- Japan's Digital Agency says VPN flaw exposed 246,000 personnel records · BleepingComputer · news