VPN Flaw Exposes Data of 246,000 Japanese Government Personnel

Japan's Digital Agency has disclosed an incident that may have exposed some 246,000 rows of records containing the personal data of government employees. The attacker gained initial access by exploiting a vulnerability in a VPN device used in the Government Solution Service (GSS) system.

The investigation began on June 25, after the agency detected mass access to files from the account of an employee responsible for maintaining and operating the system. On July 9, it emerged that a third party had penetrated the system through a vulnerability in a network device (VPN). That same day, the agency disabled the account in question, isolated the compromised equipment from the external network, and stopped any further unauthorized access.

What exactly was exposed

Exactly which VPN product was affected and which vulnerability was exploited has not been specified. However, in a separate questions-and-answers section, the agency noted that this was a medium-severity issue and not a zero-day vulnerability.

The review found the following to be at risk of exposure:

• 236,000 names;
• 231,000 email addresses;
• 94,000 phone numbers;
• 1,000 physical addresses.

Those affected may include government employees, officials, and associated companies and individuals who use the GSS system. The data of ordinary citizens was not affected, and the potentially compromised information does not include My Number identification numbers, banking details, or pension numbers.

Consequences and recommendations

The agency found no evidence that the obtained information had actually been misused, but it warned of a heightened risk of impersonation of official bodies and of phishing, urging people not to open links or attachments in unsolicited messages. The agency reminded the public that it never requests passwords or bank card details by email or phone. Those affected will be notified directly, and a dedicated support line has been opened for them.

Japan's Personal Information Protection Commission was notified on July 15. The agency attributed the delay in public disclosure to the difficulty of establishing the path of intrusion, identifying the affected information, and determining the scope of those impacted. According to the agency, the damage was limited to the compromised system: no confirmed unauthorized access or leaks were recorded in other systems, and the incident did not disrupt the availability of government services.

Source: Bleeping Computer