Japan's Digital Agency has disclosed a cyberattack on the government's common infrastructure network that may have exposed personal information belonging to approximately 246,000 public servants, contractors and other people involved in government work. According to Digital Minister Hisashi Matsumoto, the attack started in May and was first detected on June 25 when a maintenance and operations account was used to access a large number of files stored on its servers. The agency confirmed the unauthorized intrusion on July 9, when it suspended the affected account and blocked communications between the compromised network equipment and external systems to prevent further unauthorized access.
The potentially compromised information belongs to employees of government ministries and agencies using GSS, public servants who worked with those organizations, and businesses and individuals involved in their operations. As reported by the Digital Agency, around 189,000 records concern employees of GSS member organizations and other public servants involved in their work, including employees of incorporated administrative agencies. Another roughly 57,000 records relate to businesses and individuals that worked with GSS organizations. The affected files contained approximately 236,000 names and 231,000 email addresses, with roughly 94,000 phone numbers and about 1,000 addresses potentially exposed, with some records containing more than one type of personal information. Importantly, data related to My Number identification numbers, bank account details, and pension numbers were not leaked, as reported by Japan News.
Japan's Digital Agency confirmed that the personal information of members of the general public was not included in the potentially leaked files, and no misuse of the affected personal information has been identified so far. According to the agency, the affected data did not contain My Number identification numbers, bank account details or pension numbers. Officials disabled the affected maintenance account on July 9 and blocked communications between the compromised network equipment and external systems to prevent further unauthorized access. The agency issued a public apology regarding the security failure, stating that it is executing an immediate overhaul of its identity access management, multi factor authentication requirements, and privileged access monitoring frameworks to safeguard government databases against sophisticated supply chain and credential stuffing exploits. Although there are no confirmed cases of personal data misuse at this time, the agency is urging caution, as the information could be used for fraudulent purposes.
A subsequent investigation carried out with outside security specialists found that some files may have been taken from the network. The intrusion involved a vulnerability in network equipment used for VPN access, while the large-scale file activity was carried out through an account belonging to maintenance and operations personnel. The threat actors gained initial access by compromising a legitimate account assigned to an external technical contractor responsible for operational maintenance and systems support. Following the confirmation of unauthorized access, the Digital Agency immediately suspended the compromised maintenance credentials, launched internal containment protocols, and initiated forensic reviews to audit lateral movements within the network environment. The agency has not identified the attacker publicly or disclosed whether the intrusion was financially motivated. The incident emerged during a period of elevated cybercrime activity in Japan, with National Police Agency figures showing the country recorded 123 ransomware attacks during the first half of 2026.
The breach marks a high profile setback for Japan's flagship Digital Agency, established in 2021 to centralize and modernize the country's fragmented administrative IT infrastructure, lead national digital transformation, and establish standardized e-government platforms. The GSS was first introduced in 2021 and as of the end of July, about 154,000 people across 23 organizations use it, including the Agriculture, Forestry and Fisheries Ministry, the Imperial Household Agency and the National Personnel Authority. The agency's mission to create unified digital services across government departments has been significantly impacted by this security incident, highlighting the challenges of managing large-scale government IT systems and the vulnerabilities that can arise from third-party contractor access to critical infrastructure. Despite security improvements with a zero-trust network, the agency could not prevent this breach, underscoring the ongoing cybersecurity challenges in government digital transformation.
