Who this is for: administrators of VPN and remote access equipment, and staff or contractors who may hear from Japan's Digital Agency. This article is based on public information — the agency's official announcement, National Police Agency statistics and reporting — and contains no attack techniques.
What happened (per the Digital Agency)
On 11 September 2026, Japan's Digital Agency announced that unauthorised access to the Government Solution Service (GSS) — a shared work environment it builds and operates for government ministries and agencies — may have exposed personal data about staff and others. Everything below comes from the agency's official announcement.
late May 2026 (reported)
Press reports say the bulk access to files on servers began around this time. The agency's written announcement does not say so.25 Jun 2026
The agency detected a large volume of file access on servers using a maintenance operator's account and opened an investigation.9 Jul 2026
The investigation found that a third party had exploited a vulnerability in a network connection device (VPN) to get into the system. The same day, the account was suspended and the compromised device was cut off from outside communication.11 Sep 2026
The agency disclosed the personal data possibly exposed (about 246,000 records), said it would contact affected people individually, in turn, and set up a dedicated inquiry line.
- Who
- Staff of ministries and agencies using GSS, and people who worked on their operations. The agency says it has "confirmed that personal information of the general public is not included"
- Main items
- Names ~236,000 / email addresses ~231,000 / phone numbers ~94,000 / postal addresses ~1,000, among others
- Not included
- My Number (national ID), bank account details, pension numbers and similar
- Way in
- A vulnerability in a network connection device (VPN). The product and the vulnerability identifier (CVE) have not been published
- What triggered detection
- Bulk access to files on servers using a maintenance operator's account
- Secondary harm
- "At this time, no secondary harm such as misuse of personal information related to this incident has been confirmed"
- Remediation
- "Reviewing how vulnerabilities are managed, improving how external connections are made, and so on"
How to read it: do not guess at what was not published
Three things are absent from the agency's written announcement: (1) the VPN product and which vulnerability; (2) when the intrusion began; (3) how the maintenance operator's account came to be used — (2) has been reported as "around late May", but it is not in the announcement. The announcement sets two facts side by side — "got in through a VPN vulnerability" and "a maintenance operator's account was used to access a large number of files" — but does not describe what connects them. Posts naming a product, and even a specific CVE number, are circulating on social media and blogs; those are an analyst's inference, not confirmed fact. This site does not publish what cannot be confirmed from primary sources. The confirmed facts alone are enough for defenders to learn from.
Follow-up: the way in was an already-known vulnerability (minister's press conference)
From the Digital Agency's press-conference summary (11 September) and Q&A (updated 12 September)
Answering a reporter's question, the digital minister said (per the summary the agency has now published): "We were aware of the vulnerability; it was a known one. There is a vulnerability assessment, and it was not rated as highly urgent — there is a severity rating, and we were proceeding with measures according to it. After that there is work to apply patches in order, and our current understanding is that we were hacked during that." He also said the patch has since been applied.
The Digital Agency's Q&A (updated 12 September 2026) states that, in the vulnerability assessment as first published, the exploited vulnerability was rated "Medium" under CVSS. The same Q&A declines to describe the vulnerability in detail, saying that doing so could hinder security in the future.
That bulk file access began around late May comes from reporting (Nikkei xTECH and others); it is not in the Q&A, the transcript or the written announcement.
Within what can be confirmed, one thing follows. The attackers got in through an already-known vulnerability, not an unknown one (a zero-day). That makes it a question of the order in which vulnerabilities were patched.
This site's view: ordering was not the mistake — what the order was based on is the issue
Prioritising vulnerabilities is correct practice; nobody can fix everything at once. The question is what decides the order. This site has argued in prioritising with CVSS, EPSS and KEV that a severity score alone must not set the order, because CVSS answers "how much damage could this do if exploited" and says nothing about whether it is actually being exploited, or where the affected device is placed.
The minister's account is exactly that shape: a vulnerability assessed as not highly urgent sat on a boundary device reachable by anyone on the internet (CVSS "Medium", per the agency's Q&A). A "Medium" deep inside the network and a "Medium" on an internet-facing VPN appliance are not the same thing. So the ordering needs (1) is it known to be exploited (KEV), (2) how likely is exploitation soon (EPSS), and (3) is the device on the internet-facing boundary. Look only at the score, and a vulnerability left for later because "it's only Medium" is the one attackers use.
Why VPN appliances are the favourite target
This is not only about the Digital Agency. In National Police Agency statistics on ransomware in Japan, VPN devices have remained the most common way in among cases where the route is known.
Security awareness training tends to focus on "do not open suspicious email", but statistically the most common way in is equipment placed facing the internet. The reason is structural.
Anyone on the internet can reach it
A VPN vulnerability is exploited
Inside, it acts as a legitimate account
Broad privileges reach a mass of files
Control 1: patch speed
Known-exploited flaws first
Control 2: narrow privileges
No maintenance account reads everything
Control 3: detect bulk access
Where the agency noticed
Why VPN appliances get targeted
- They sit where the internet can always reach them
- Compromising one puts an attacker inside the organisation
- Activity inside looks like a legitimate user
- The device's own OS is out of sight, so updates slip
- The installer and the operator are often different parties, so nobody clearly owns patching
What the organisation decides
- Knowing which devices, at which versions, you run
- A deadline for how many days a known-exploited flaw may stay unpatched
- What one account can read once inside
- A way to notice unusual volume or unusual hours of access
- Whether to keep running the device at all
What to do today if you run VPN appliances
Inventory your VPN and remote access devices
Start with a list: model, firmware version, location and the person responsible for updates — not only VPN appliances but remote desktop gateways and firewall management interfaces too. Devices "handled by the vendor who installed them" are often the ones nobody knows the current state of. A device you do not know about is a device that does not get patched. The approach is laid out in the security inventory checklist.
Set a deadline for patching known-exploited vulnerabilities
Track vendor advisories and the catalogue of vulnerabilities known to be exploited (CISA KEV). A KEV entry is not "might be targeted someday" but "is being targeted now". For ordering by more than a severity score, see prioritising with CVSS, EPSS and KEV; for the working procedure, see the vulnerability remediation playbook.
After patching, rotate the credentials too
On a device that may have been exploited, a patch does nothing about credentials stolen before it was applied. Rotate the passwords, certificates and keys stored on or passed through that device, and look for accounts or configuration changes you do not recognise. Patching the vulnerability and cutting off the intruder's access are two different jobs.
Do not give maintenance or contractor accounts the power to read everything
In the Digital Agency case, the account used for bulk file access was a maintenance operator's account. The announcement does not describe that account's privileges, but in general maintenance accounts tend to be given broad privileges for convenience. Limit them to what the job needs, enable them only when in use, restrict where they can connect from, and require multi-factor authentication. Even if attackers get in through the VPN device, an account that can reach little limits the damage. The pattern of maintenance and contractor paths being targeted also appears in the Osaka General Medical Center case (2022), where the investigation committee pointed to a contractor's remote-maintenance VPN device as the way in.
Make sure you would notice unusual volumes of access
What alerted the Digital Agency was a large volume of file access. It did not stop the intrusion, but detection is what let the agency scope it and cut it off. Alerts on file servers and cloud storage for bursts of downloads, bulk access at night, and use of dormant accounts can be set up without expensive products.
Concretely: on Windows file shares, count the security events (4663 — object access, 5145 — network share access check) per day and alert only on days several times higher than usual. In cloud suites, Google Workspace’s alert centre and Microsoft 365’s audit log and alert policies can fire on bulk downloads (what you get depends on your plan). Express the threshold as a multiple of normal rather than an absolute number; as a first rule, that is the one that works.
For the underlying ideas, see indicators of attack (IoA) and EDR.
Decide whether to keep the device at all
If there is no one and no budget to keep up with updates, running the device is itself the risk. Alternatives — connection methods that do not expose a connection point to the internet, or services where the provider owns patching — do not solve everything, but they are worth weighing because they make it clear who is responsible for updates.
If you may be contacted as staff or a contractor
Someone knowing your name and department is not proof they are genuine
The data possibly exposed is mostly names and email addresses — the combination used as a target list for impersonation email aimed at specific people (phishing). The Digital Agency asks people to watch for suspicious emails, calls and SMS messages impersonating the agency or related bodies, not to open links or attachments in unexpected messages, and never to enter credentials or card details.
If you want to check something, go to the Digital Agency's official website yourself rather than using a number or link from the message. Since about 94,000 phone numbers are also in scope, the same rule applies to calls that claim to be "verifying" something.
This site's view: what is worth copying here is that they noticed
Sakura Internet's investigation results, published days earlier, showed unauthorised access to its sales management system running for about three years (what to do when your web host is breached). By contrast, the Digital Agency incident was detected through an anomaly in volume — bulk file access. The intrusion itself was not prevented, so this is not a complete success. Still, since nobody can prevent every intrusion, the real difference is how quickly you notice once someone is in.
On the other hand, about two and a half months passed between detection (25 June) and disclosure (11 September), and the announcement does not describe that period. Scoping an incident often takes time, and that alone is not unusual. But from the affected person's side, it means learning months later that your contact details may have reached a third party. So rather than waiting to be contacted, it makes sense to be on guard against impersonation starting today.
Sources
The facts above come from the following public records. No speculation about the unpublished product name or intrusion details.
- Digital Agency (Japan), "On the possible leak of personal information of staff and others due to unauthorised access to the Government Solution Service" (published 11 September 2026, Japanese) — digital.go.jp
- National Police Agency (Japan), "The state of threats in cyberspace in 2025", statistics section on ransomware infection routes (of 92 valid responses, 61 VPN devices and 19 remote desktop; over five years, 293 of 485 were VPN devices; Japanese) — npa.go.jp
- Reporting by INTERNET Watch, ITmedia NEWS and Jiji Press (11 September 2026), all based on the announcement above
- Digital Agency (Japan), summary of the digital minister's press conference of 11 September 2026 (Japanese) — digital.go.jp
- Digital Agency (Japan), Q&A on the possible leak of personal information of staff and others due to unauthorised access to the Government Solution Service (updated 12 September 2026, Japanese) — digital.go.jp
- Nikkei xTECH, report on the GSS intrusion (11 September 2026, Japanese) — the minister's press-conference remarks and the start of bulk access come from this and similar reporting — xtech.nikkei.com
Update log
2026-10-11: Correction. The 19 September update kept CVSS "Medium" attributed to reporting because it was not in the press-conference summary. The Digital Agency's Q&A (updated 12 September 2026) states it directly: "Medium" in the vulnerability assessment as first published. The text now attributes the rating to the Q&A, which has been added to the sources. "Late May" is not in the Q&A either, so it remains attributed to reporting.
2026-09-19: Confirmed against the press-conference summary the Digital Agency published. The account that the vulnerability was already known and was being patched in order of assessed severity when the intrusion happened — and that the patch is now applied — is now quoted from the official summary rather than from reporting. CVSS "Medium" and "late May" are not in the summary, so they remain attributed to reporting.
2026-09-12: Added a reported follow-up. The minister is reported to have told the 11 September press conference that the exploited VPN vulnerability was already known and was queued behind more urgent ones, and that it was rated "Medium" under CVSS. Bulk file access is reported to have begun around late May. None of this is in the agency's written announcement, so it is attributed as reporting. It will be re-checked against the official transcript once published.
2026-09-11: First version, based on the Digital Agency's 11 September announcement and the National Police Agency's 2025 statistics.
Read next
- Related: Exploited edge device vulnerabilities, mid-October 2026
- Mass credential leak: FortiBleed (FortiGate credential leak): not a new vulnerability, passwords must be changed
- The organization-wide minimum: Six priorities worked back from Japan’s 2026 breaches
- Comparing 2026's major cases: what KDDI, Aflac, the Digital Agency and Sakura Internet have in common
- Practice: Prioritising vulnerabilities with CVSS, EPSS and KEV / Vulnerability remediation playbook / Choosing multi-factor authentication
- Cases where a VPN device was the way in (Japan): Osaka General Medical Center (2022) / Tsurugi Handa Hospital (2021) / Capcom (2020)
- A management plane attacked repeatedly: VeloCloud Orchestrator vulnerabilities (three exploited in three months)
- Trends: Breaches in 2026 run on valid credentials more than vulnerabilities
- Terms: What is ransomware / What is phishing