The breach came through a known VPN flaw

On 11 September this desk reported that VPN equipment was the most common entry point in Japan's record half-year of ransomware. On the same day, the government agency responsible for the country's digital infrastructure disclosed that it had been breached the same way.

Japan's Digital Agency said an attacker exploited a vulnerability in a VPN device to reach the Government Solution Service, a shared IT platform used across ministries and government bodies. About 246,000 rows of personal data were exposed.

The contents are specific: roughly 236,000 names, 231,000 email addresses, 94,000 telephone numbers and 1,000 workplace addresses. Cybersecurity News reports that about 189,000 of the records relate to public officials and 57,000 to contractors. My Number identifiers, bank details and pension numbers were not included.

The agency began investigating on 25 June, after spotting a large volume of file access from an account belonging to a maintenance and operations worker. On 9 July it established that a third party had used the VPN flaw to get in, suspended the account and cut the affected equipment off from outside connections. The Personal Information Protection Commission was notified on 15 July.

Public disclosure took another two months. The agency attributed the delay to the complexity of establishing how the intruder got in, which is a real difficulty and also a long time for 246,000 people not to know their contact details had left the building.

The detail that should trouble every security team is the vulnerability's description. The agency rated it medium severity and said it was not a zero-day. It has not named the product. A flaw that was already known, and that nobody scored as critical, was enough to open a platform shared across the Japanese government.

Severity scores measure a flaw in isolation. They do not measure where the flaw sits, and a medium-rated bug on an internet-facing appliance that hands out network access is more dangerous in practice than a critical one on a server nobody outside can reach. Patching queues ordered by score get that backwards.

The maintenance account is the second lesson. Operations staff hold broad access because their job requires it, and an intruder moving through their credentials looks at first like somebody doing that job. What gave this one away was the volume of files it opened, not the way it got in.

No misuse of the data has been detected, and the agency has warned those affected about phishing and impersonation. That warning is the realistic harm: a clean list of government email addresses matched to names and telephone numbers is exactly what a targeted campaign against officials would be built from.

The agency says it will overhaul how it manages vulnerabilities and secures external connections. It is the correct commitment, and it is the same one the police statistics made necessary for everyone else the day before.