Loading story…
Japan’s Digital Agency disclosed that an unidentified external party exploited an unpatched, medium-severity vulnerability in a VPN device supporting the Government Solution Service (GSS), the shared network platform used by 23 ministries and agencies. The intrusion began around late May and was detected on June 25 after suspicious activity and large-scale file access through a system-maintenance administrator account; investigators confirmed the compromise on July 9.
The breach may have exposed personal data for approximately 246,000 government employees, public officials, contractors, and businesses supporting government work. The agency suspended the abused maintenance account, isolated affected equipment, and notified Japan’s privacy regulator; it reported no confirmed data misuse, impact to other systems, or disruption of government services, but warned that exposed contact information could enable targeted phishing and social-engineering impersonation attempts.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
The agency disclosed that files containing personal information may have been exfiltrated, potentially exposing about 246,000 records. The affected information included names, email addresses, telephone numbers, and some physical addresses; no confirmed misuse had been reported.
Japan’s Digital Agency notified the Personal Information Protection Commission about the GSS breach.
The Digital Agency determined that a third party had exploited the VPN flaw to infiltrate GSS. It suspended the maintenance account used in the intrusion and severed external communications from the compromised equipment.
Japan’s Digital Agency detected suspicious activity through a system-maintenance administrator account, involving access to a large volume of files on the GSS network.
An unidentified external party began repeatedly accessing Japan’s Government Solution Service network by exploiting a known medium-severity VPN vulnerability that had not been patched.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Aflac Life Insurance Japan disclosed that an unauthorized third party accessed its systems between June 15 and June 25, exposing data tied to about **4.38 million customers**. The company said the compromised information included names, dates of birth, addresses, phone numbers, policy coverage details, and data related to insurance representatives and commercial agencies; roughly **230,000 records** also contained bank account information. Aflac said the incident was limited to its Japan operations, that U.S. business systems were not accessed, and that affected systems were suspended after the intrusion was discovered on June 25. The breach adds to a broader pattern of cyber incidents affecting Japanese organizations, where public reporting has shown hundreds of ransomware and extortion-related cases and frequent abuse of internet-facing systems such as VPN appliances and RDP. Research on disclosed incidents involving Japanese firms found that attackers often move quickly to leak or weaponize stolen data and increasingly time disruptive actions for nights or weekends, underscoring the operational pressure facing defenders. Aflac said it has brought in third-party cybersecurity experts and notified Japan’s Financial Services Agency and police, while stating that no confirmed misuse of the stolen data had been identified at the time of disclosure.
Jul 7, 2026
KDDI disclosed unauthorized access to an email platform it operates for itself and multiple Japanese internet service providers, warning that up to **14.22 million** email account records may have been exposed. The affected service supports KDDI and providers including **STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and BIGLOBE**. KDDI said the intrusion was detected on June 17 and linked to exploitation of a vulnerability in third-party software used by the system, after which it blocked further access and added defensive measures. The potentially exposed data includes email addresses, passwords, and some personal information tied to active, dormant, and canceled accounts. KDDI said the password data was hashed or encrypted, but it has not publicly clarified the protection status or algorithms for all records, and the full scope of the incident remains under investigation. The company reported the breach to Japan’s **Personal Information Protection Commission** and the **Ministry of Internal Affairs and Communications**, and is coordinating customer notifications and password resets with the affected ISPs.
Jun 30, 2026
KDDI disclosed that a cyberattack against an email platform it operates for five Japanese internet service providers exposed more than **12.2 million customer email addresses** and **7.6 million passwords**. The compromised system supported customer account management, webmail, and email storage, and the company said the intrusion was enabled by a vulnerability in third-party software used by the platform. KDDI initially reported the unauthorized access in June and later confirmed the scale of the breach after a forensic investigation and notification to Japan’s communications ministry. The company said it patched the flaw and modified the affected system immediately after detecting the attack, adding that investigators found no evidence of compromise beyond exploitation of the vulnerable software. KDDI also said its own consumer email services for mobile and fixed-line internet customers run on separate infrastructure and were not affected. The incident has prompted affected ISPs to coordinate mandatory password resets for impacted users and underscored the risk that a single flaw in shared third-party software can cascade across multiple providers.
Jul 9, 2026