Japan's Digital Agency Suffers Data Breach Affecting 240,000 Individuals
A data breach at Japan's Digital Agency has exposed the personal information of approximately 240,000 individuals, stemming from a vulnerability in a VPN product.
Japan's Digital Agency has announced a significant data breach that has compromised the personal information of around 240,000 individuals. The incident, discovered in late June, involved unauthorized access to the agency's Government Solution Service (GSS) system. Attackers gained entry using the credentials of a maintenance and operations employee.
An investigation conducted in July revealed that the breach was facilitated by the exploitation of a vulnerability within a VPN product. This allowed the threat actors to access and exfiltrate data from the GSS. The agency reported that over 246,000 records were compromised, including names, addresses, email addresses, and phone numbers. The affected individuals include users of the GSS, public officials, administrative staff, and various businesses and individuals interacting with the service.
The compromised data primarily consists of information provided by users when applying for GSS access. While names, email addresses, and phone numbers were affected, the agency clarified that more sensitive data such as individual identification numbers and financial account information were not compromised. Most of the exposed addresses and phone numbers were associated with the individuals' workplaces, often government buildings or offices.
Upon confirming the exploitation, Japan's Digital Agency took immediate action to mitigate further damage. External access to the compromised server was blocked, and the employee account used in the attack was suspended. The agency acknowledged that the exploited vulnerability had been publicly disclosed prior to the attack, underscoring a gap in their vulnerability management processes. They have committed to strengthening these procedures moving forward.
While the specific VPN product that was exploited was not named, the agency emphasized its commitment to enhancing its security posture. The incident serves as a stark reminder of the critical importance of securing network perimeter devices and promptly patching known vulnerabilities. The agency stated that no other internal systems were compromised as a result of this incident, and no information belonging to the general public outside of the GSS user base was affected.
This breach highlights a persistent challenge in cybersecurity: the exploitation of vulnerabilities in widely used network infrastructure components like VPNs. Such attacks can have far-reaching consequences, impacting government services and the personal data of a large number of citizens. The incident underscores the need for continuous monitoring, robust patch management, and stringent access controls to protect sensitive government systems.
The new article provides further details on the exploited vulnerability, noting it was not a zero-day and a patch was publicly available prior to the attack, raising concerns about the agency's patch management. It also clarifies the timeline, indicating suspicious activity was detected on June 25th, but the attacker had been active since late May, with the breach going undetected for nearly a month. The agency has pledged to overhaul its vulnerability management and external connection security practices.