Japan’s Digital Agency has disclosed a data breach affecting the personal information of approximately 240,000 individuals.
The incident, it says, was discovered in late June, after the hackers accessed files from its Government Solution Service (GSS) using a maintenance and operations employee’s account.
In July, the investigation determined that a vulnerability in a VPN product had been exploited to access the system.
According to the agency, the attackers compromised over 246,000 records containing names (approximately 236,000), addresses (~1,000), email addresses (~231,000), and phone numbers (~94,000).
The compromised information, it says, belongs to users, public officials, administrative staff, and businesses and individuals working with GSS.
The leaked information had been provided by every individual when applying to use GSS, and most of the addresses and phone numbers are associated with the individuals’ workplace, namely a government building or an office, the agency explains in an accompanying FAQ.
Other personal information, such as individual identification numbers and financial account information, was not affected.