🔐 Digital Agency Breach: 246,000 Records May Have Leaked

❓ What happened?

On September 11, 2026, Japan's Digital Agency announced that the Government Solution Service (GSS) — the shared IT platform it operates for government bodies — had been accessed without authorization from outside, and that some files containing personal information handled on GSS may have leaked. The timeline: on June 25, 2026, the agency detected that a maintenance operator's account was being used to access large volumes of files on a server, and opened an investigation. On July 9 it confirmed that a third party had broken into the system by exploiting a vulnerability in a network connection device (VPN). The same day it suspended that account and cut off communication between the compromised device and the outside, stopping further unauthorized access. A follow-up investigation with outside specialists confirmed that personal data may have left the system. About 246,000 records may have been exposed: roughly 189,000 belonging to staff of GSS-using ministries and agencies and public officials involved in their work (including staff of incorporated administrative agencies), and roughly 57,000 belonging to companies and individuals engaged in that work. By item (with overlap): names about 236,000, email addresses about 231,000, phone numbers about 94,000, addresses about 1,000. My Number, bank account details and pension numbers were confirmed not to be included. The data concerns government staff and people who worked with them — personal information of the general public is not involved. The agency says it will review its vulnerability management and improve how external connections are made.

👥 Who is affected?

• ●Staff of ministries and agencies that use GSS (part of the ~189,000 records)
• ●Public officials involved in the work of GSS-using bodies, including staff of incorporated administrative agencies
• ●Companies contracted for that work, and individuals who took part in it (~57,000 records)
• ●Foreign residents who worked on government projects as interpreters, translators, IT engineers, researchers and so on, if registered as a contractor or individual
• ●Members of the general public are NOT affected — the Digital Agency has confirmed this

🌏 Impact on foreign residents

Those directly affected are government staff and the companies and individuals who worked with them. If you are a foreign resident who has taken on a government project — as an interpreter, translator, IT engineer, designer, or researcher, whether freelance or as a company employee — your name, email address and phone number may be among the records. The Digital Agency says it will identify affected people and contact them individually in stages, so until you hear from them you cannot know whether you are on the list. The second risk touches far more people: scams riding on the news. The agency explicitly warns that the data could be abused for impostor and phishing emails. Expect Japanese- or English-language emails and SMS claiming to be from the "Digital Agency" or "Mynaportal" and pushing you to a page that asks for a password or credit card number. Foreign residents who are less used to official Japanese documents are the most likely to have trouble telling real from fake. The Digital Agency never asks for authentication credentials or credit card details by email or phone. As of the announcement, no secondary damage such as misuse of the leaked data has been confirmed.