Japan’s Digital Agency reports that up to 246,000 records may have been exposed following a cyberattack.

Japan’s Digital Agency has reported that a cyberattack on the government’s network may have resulted in the theft of personal information belonging to approximately 246,000 government staff, contractors, and other personnel. In a report released on September 11, the agency stated that an investigation into its Government Solutions Service (GSS) revealed that third-party hackers compromised virtual private network (VPN) equipment to access personal information contained in various files. The attack was first detected on June 25, when a maintenance and operations account was used to access thousands of files stored on the agency’s servers.

VPN Vulnerability Leads to Unauthorized Access to Government Files
On July 9, it was determined that a third party had infiltrated the system by exploiting a VPN vulnerability. The compromised maintenance account was immediately disabled, and communications between the network equipment and external systems were severed to prevent further unauthorized access. With the assistance of external security experts, a subsequent investigation indicated that some files within the network may have been stolen.

The leaked data concerns employees of government departments and agencies that use the GSS system, civil servants who have participated in the work of these entities, as well as companies and individuals associated with the operations of GSS-affiliated organizations. Approximately 189,000 records pertain to employees of GSS-member agencies and civil servants involved in the activities of these agencies. In addition, there are about 57,000 records relating to companies and individuals.

According to Japan’s Digital Agency, the leaked information does not include personal identification numbers, bank account details, or pension numbers. The agency has assured the public that the personal information of ordinary citizens has not been compromised. It further stated that there is currently no evidence of any personal data being misused. Authorities are working to identify the individuals whose data was exposed and are reaching out to them directly.

The statement warns that this contact information could be used for impersonation or phishing attacks. Affected individuals are urged to refrain from opening any links or attachments, and to avoid responding to emails, phone calls, or text messages—even those that appear to be from government agencies. Furthermore, they should never share passwords, verification codes, or credit card information.

Security incidents involving access rights and infrastructure—even those occurring outside of government systems—are always a cause for concern. The on-chain security platform Blockaid reported that the cryptocurrency sector suffered losses totaling $1 billion (approximately 95.55 billion rupees) in the first half of 2026, marking one of the most severe periods for hacking in the industry’s history. The Ethereum and Solana blockchain networks were the most heavily impacted by these system-level attacks.

Cryptocurrency is an unregulated form of digital currency; it is not legal tender and carries market risk. The information provided in this article is not intended to be, nor does it constitute, financial advice, trading advice, or any other form of advice or recommendation from NDTV. NDTV shall not be held liable for any losses incurred from investments made in reliance on any advice, forecasts, or other information contained in this article.