Digital Agency says personal information possibly leaked
No secondary damage, such as the misuse of the possibly leaked personal information, has been confirmed so far.
The Digital Agency said Friday that about 246,000 sets of personal information, including the names and email addresses of government employees, may have been leaked due to unauthorized access to a network system.
No misuse of the information has been confirmed so far, the agency said.
The unauthorized access occurred on the Government Solution Service, a system commonly used by government ministries and agencies.
The agency said it detected suspicious activity from the account of a system maintenance administrator on June 25. It then began investigating and found on July 9 that an external third party had repeatedly accessed the system since around late May.
“We take it seriously that the incident occurred despite our operations under multi-layered security measures and a 24-hours-a-day, 365-day-a-year surveillance system,” Chief Cabinet Secretary Minoru Kihara said at a news conference, adding that the agency would work to prevent a recurrence.
The breach affects some 189,000 government employees and around 57,000 private-sector workers involved in government duties. The information included their addresses and phone numbers, but not My Number personal identification numbers or bank account information.
The Digital Agency determined that the cyberattack exploited a vulnerability in virtual private network equipment to access the system remotely. The agency was aware of the vulnerability but yet to apply a patch.
Following the possible information breach, the agency warned of emails or phone calls from people posing as the agency.