Japan’s Digital Agency has disclosed a data breach affecting the personal information of approximately 240,000 individuals.
The incident, it says, was discovered in late June, after the hackers accessed files from its Government Solution Service (GSS) using a maintenance and operations employee’s account.
In July, the investigation determined that a vulnerability in a VPN product had been exploited to access the system.
According to the agency, the attackers compromised over 246,000 records containing names (approximately 236,000), addresses (~1,000), email addresses (~231,000), and phone numbers (~94,000).
The compromised information, it says, belongs to users, public officials, administrative staff, and businesses and individuals working with GSS.
The leaked information had been provided by every individual when applying to use GSS, and most of the addresses and phone numbers are associated with the individuals’ workplace, namely a government building or an office, the agency explains in an accompanying FAQ.
Other personal information, such as individual identification numbers and financial account information, was not affected.
Japan’s Digital Agency blocked external access to the affected server and suspended the employee account used in the attack immediately after confirming the exploitation.
While it did not name the exploited VPN product, it said it would strengthen vulnerability management, as the targeted vulnerability had already been publicly disclosed before the attack was confirmed.
No other systems were compromised in the attack, and no information of the general public was compromised, the agency said.
Related: Hacked HBO Max Reddit Account Used for Malware Delivery via ClickFix Attack
Related: Personal, Financial Info Exposed in Revolut Data Breach
Related: Trezor Says 347,000 Users Received Phishing Emails After Brevo Hack
