CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Japan Digital Agency GSS unauthorized-access incident (2026-09)

incident · incident:japan-digital-agency-gss-breach-2026-09

VPN-vulnerability intrusion into Japan's government-wide Government Solution Service (GSS) shared IT platform, exploited from around late May 2026 and detected 2026-06-25 via anomalous privileged-account file access; disclosed 2026-09-11 with ~246,000 potentially exposed personal-data records (Digital Agency, 2026-09-11).

Aliases: デジタル庁 GSS 不正アクセス

Coverage
1
first 2026-09-12 → last 2026-10-21
Latest activity
2026-09-12
A file-access alert, not the VPN exploit, exposed Japan's GSS breach; the flaw was already known and…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector · regions: apac
Sources cited
3
3 hosts

Defender insights

What each entry about Japan Digital Agency GSS unauthorized-access incident (2026-09) tells a defender to do, newest first.

2026-09-12NOTABLEA file-access alert, not the VPN exploit, exposed Japan's GSS breach; the flaw was already known and mid-remediation

Story timeline

  1. 2026-09-12Japan's Digital Agency: a VPN vulnerability exploited since May went undetected for a month, surfaced only by an anomalous mass file-access alert on a maintenance account, exposing ~246,000 government-personnel records
    active-threatsA file-access alert, not the VPN exploit, exposed Japan's GSS breach; the flaw was already known and mid-remediation

Hunting pivots

Tags
data-breachidentity
ATT&CK techniques (3 across 5 tactics)

3 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts · Exploit Public-Facing Application
  • PersistenceValid Accounts
  • Privilege EscalationValid Accounts
  • StealthValid Accounts
  • CollectionData from Local System

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-12/japan-digital-agency-gss-vpn-breach-maintenance-account · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-12/japan-digital-agency-gss-vpn-breach-maintenance-account · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-12/japan-digital-agency-gss-vpn-breach-maintenance-account · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-12/japan-digital-agency-gss-vpn-breach-maintenance-account · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-09-12/japan-digital-agency-gss-vpn-breach-maintenance-account · ATT&CK page ↗

Collection TA0009

T1005Data from Local System×1

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

Evidence: 2026-09-12/japan-digital-agency-gss-vpn-breach-maintenance-account · ATT&CK page ↗

Entries about Japan Digital Agency GSS unauthorized-access incident (2026-09) (1)

2026-09-12 · view entry permalink →

NOTABLEupdatedNATOB2

Japan's Digital Agency: a VPN vulnerability exploited since May went undetected for a month, surfaced only by an anomalous mass file-access alert on a maintenance account, exposing ~246,000 government-personnel records

Japan's Digital Agency confirmed on 2026-09-11 that unauthorized access from outside to its Government Solution Service (GSS), the shared base of work PCs, networks, office software, communication tools and security measures it provides to ministry staff (Rocket Boys Security Measures Lab, 2026-09-11), may have leaked files holding about 246,000 records of personal data (Digital Agency, 2026-09-11): about 236,000 names, 231,000 email addresses, 94,000 phone numbers and 1,000 addresses, with duplication across fields (Piyolog, 2026-09-11). The agency states no National ID, bank-account or pension data was involved, and no general citizen data, only GSS-using-agency staff, associated public servants, and contracted businesses (Rocket Boys Security Measures Lab, 2026-09-11). No secondary misuse has been confirmed as of the disclosure date (Piyolog, 2026-09-11).

The root cause was a third party exploiting a vulnerability in an externally-facing VPN appliance used for maintenance access, gaining a foothold from around late May 2026 (Piyolog, 2026-09-11). The intrusion was not detected from the VPN compromise itself: on 25 June the agency detected that a maintenance and operations staff account had been used to access a large number of files on a server, and only the investigation that followed found, on 9 July, that a third party had entered the system through the VPN vulnerability (Digital Agency, 2026-09-11). The agency disabled the account and cut the compromised device's external connectivity the same day, then patched the VPN appliance as an initial response (Piyolog, 2026-09-11); roughly two and a half months of investigation with an external forensics firm preceded the public announcement.

At the 2026-09-11 press conference, Digital Minister Matsumoto stated the exploited vulnerability was already known to the agency before the intrusion, rated at around "Medium" severity in the vulnerability assessment published at the time, and was being remediated on a severity-based schedule when it was exploited ahead of that fix being applied (Digital Agency Q&A, relayed by Piyolog, 2026-09-11). The agency stated it will review its vulnerability-management methods and improve how connections from outside are made, without disclosing specifics on what will change (Rocket Boys Security Measures Lab, 2026-09-11).

The Digital Agency said that in the vulnerability assessment published at the time, the Common Vulnerability Scoring System rated the severity at around "Medium", and explained that it was exploited before a fix or patch had been applied (translated from Japanese)

Piyolog (Piyokango), Japanese security incident-tracking blog 2026-09-11

On 25 June 2026, we detected that a large number of files on a server had been accessed using the account of a maintenance and operations staff member, and began an investigation (translated from Japanese)

On 9 July, it was found that a third party had exploited a vulnerability in a network connection device (VPN) to intrude into the system and had been carrying out unauthorized access (translated from Japanese)

Digital Agency (Japan) 2026-09-11
Correctionrun 2026-09-13T1307Z-auditclassificationsourcing_note

The confidence first conveyed here was too high, and the reason matters for how a reader weighs it. Every fact here traces to one disclosure: the Digital Agency's 2026-09-11 press release and the accompanying press conference. Jiji Press, Piyolog and Rocket Boys Security Measures Lab each report that announcement; none of them examined the intrusion. Independent corroboration means a second party that observed or assessed the thing, not a second outlet that republished the first, so the account is probably true but not independently confirmed. Nothing factual in the entry changes: the figures, the scope and the agency's statements were re-verified against the same sources and hold. What changes is that a reader should treat the account as the Digital Agency's own, still awaiting outside confirmation: the VPN vendor, the product and the CVE remain undisclosed by any party.

Correctionrun 2026-09-20T1308Z-auditevidencebody

The Digital Agency's statement on the flaw's severity is narrower than first rendered here. Piyolog's account of the 2026-09-11 press conference reports the agency saying that the Common Vulnerability Scoring System rated the severity at around "Medium" in the vulnerability assessment published at the time, and that the flaw was exploited before a fix or patch had been applied (Piyolog, 2026-09-11). The qualification matters: the agency described the rating as it stood when first published, not as a settled assessment of the flaw.

Improvementrun 2026-10-21T1149Z-auditbodyevidenceheadlinesourcessourcing_notesummary

The Digital Agency's own notice of 2026-09-11 confirms the 25 June detection and the 9 July finding that a third party had entered through a VPN vulnerability (Digital Agency, 2026-09-11). It splits the roughly 246,000 records into about 189,000 on staff of the agencies using GSS and the public servants working on their business (staff of independent administrative agencies included) and about 57,000 on the businesses and individuals involved, and besides reviewing vulnerability management it commits to improving how connections from outside are made (Digital Agency, 2026-09-11). At the 2026-09-11 press conference the minister said the agency had known of the exploited VPN flaw before the incident and was working through vulnerabilities in order of urgency when it was exploited (Piyolog, 2026-09-11).

incident12 Sep 04:09Zmulti-sourceOpen finding →
Sources: Digital Agency (Japan) · Piyolog (Piyokango), Japanese security incident-tracking blog · Rocket Boys Security Measures Lab

explore in graph

Where this entity is cited

  • Threats1

Source distribution

  • digital.go.jp1 (33%)
  • piyolog.hatenadiary.jp1 (33%)
  • rocket-boys.co.jp1 (33%)
All cited sources (3)