In the Government Shared Services (GSS), a common government operational environment provided by the Digital Agency, unauthorized access exploiting vulnerabilities in VPN equipment occurred, raising the possibility that personal information for approximately 246,000 individuals—including government officials and contractors—may have been leaked. Behind this incident lie blind spots in security management that rely on conventional vulnerability assessment scores and challenges in privilege management within zero-trust operations.

Timeline from Unauthorized Access Detection to Public Announcement and Extent of Damage

The Government Solution Service (GSS), promoted by the Digital Agency, is a government-wide standard operational platform used by approximately 154,000 officials across 23 organizations, including government ministries and agencies and Incorporated Administrative Agencies. On September 11, 2026, the Digital Agency announced that the GSS had suffered unauthorized external access, and that some files containing handled personal information may have been leaked. The incident came to light on June 25, 2026, when it was detected that a maintenance and operations personnel account was used to access a large volume of files on the server. As a result of investigations conducted in cooperation with an external cybersecurity firm, it was revealed on July 9, 2026, that a third party had gained entry by exploiting a vulnerability in VPN equipment. The Digital Agency suspended the account in question and cut off communications for the compromised device on the same day, and completed its report to the Personal Information Protection Commission on July 15. Personal information that may have been leaked totals approximately 246,000 items. The breakdown consists of approximately 189,000 items of information on officials of GSS-using organizations and public servants engaged in operations, and approximately 57,000 items of information on contractors and individuals. By attribute, this includes approximately 236,000 names, 231,000 email addresses, and 94,000 phone numbers. It has been confirmed that highly confidential information such as My Number numbers, financial institution account information, and pension numbers, as well as data on the general public, are not included, and that the majority of phone numbers and addresses are official contact points or government building locations. Please refer to the figure below.

The VPN devices that served as the intrusion route and the abuse of maintenance and operation accounts

In this cyberattack, the foothold for the intrusion was a VPN device used for external maintenance and operations. Attackers are believed to have begun infiltrating the GSS internal network around late May 2026 by exploiting vulnerabilities in the VPN equipment. After infiltrating, the attackers illegally acquired and abused account information used for system maintenance and operations, seizing access privileges to internal servers. In large-scale government IT infrastructures like GSS, privileged accounts exist that hold operation rights over a wide range of system areas and file groups. When a maintenance and operation account is compromised, the attacker impersonates a legitimate administrator and acts as if performing authorized operations, making detection in the early stages of intrusion extremely difficult. In fact, the Digital Agency’s trigger for detecting the anomaly was not the blocking of the intrusion itself, but rather the unnatural behavior of accessing a large number of files within the server after the intrusion. This incident demonstrates the high level of risk when powerful privileges are abused internally after defenses at the network perimeter have been breached. Upon discovery, the Digital Agency implemented containment measures such as applying patches, changing authentication credentials, and blocking external communications, confirming that new unauthorized access has been blocked. However, this has highlighted the importance of protecting operational management accounts and maintaining monitoring systems.

Why It Couldn’t Be Prevented: The Trap of CVSS “Medium” Ratings and the Reality of Zero Trust

Technical Background of Exploited Known Vulnerabilities with Medium Severity

An extremely important point in this incident is that the vulnerability in the VPN device exploited in the attack was evaluated as having a “Medium” severity level in the Common Vulnerability Scoring System (CVSS) at the time of its disclosure. The Digital Agency was aware of the existence of this vulnerability before the attack occurred and was proceeding with remediation at an accelerated pace ahead of the general response schedule corresponding to its evaluation level. However, it was ultimately exploited by attackers just before the patching work could be completed. The CVSS Base Score is an indicator that evaluates the technical characteristics of the vulnerability itself, and does not take into account actual attack activity or the criticality of the targeted assets within one’s own organization. Therefore, when prioritizing based solely on CVSS scores, a structural challenge exists where “Medium”-level vulnerabilities—which are not classified as urgent or critical—are easily deprioritized or addressed too late. Globally, a transition toward effective risk assessment is underway; for example, the U.S. CISA issued Directive BOD 26-04 in June 2026, moving away from a blanket reliance on traditional CVSS to determine remediation deadlines by considering multiple variables such as Known Exploited Vulnerabilities (KEV) and the Exploit Prediction Scoring System (EPSS). Reflecting on this incident, the Digital Agency has also announced a policy shift toward vulnerability management based on the actual risks to systems rather than simply following score order.

Misconceptions About Zero Trust Architecture and the Limits of Internal Boundaries

GSS was built and operated based on the “Zero Trust Architecture” concept, which does not trust communication regardless of whether it is inside or outside the network. Despite this, the occurrence of unauthorized intrusion and the possibility of personal information leakage have raised doubts about the effectiveness of the security model. However, in the government’s unified standards, Zero Trust is defined as a design philosophy that aims to minimize risk on the premise that the network is constantly compromised, and is not a magic tool to prevent intrusion 100 percent. In this incident, after the intrusion occurred from a boundary connection point called a VPN, the credentials of a highly privileged entity—the operation and maintenance account—were abused, which contributed to the spread of the damage. Questions will be raised as to how effectively access control after connection was permitted, the thorough application of multi-factor authentication (MFA) to privileged accounts, and the narrowing down of access scope based on the principle of least privilege functioned. The National Cyber Directorate also revised its guidelines on June 12, 2026, urging the strengthening of internal boundary defenses, such as mandating the introduction of multi-factor authentication in principle for entities with strong privileges. As a recurrence prevention measure, the Digital Agency has proposed rebuilding defense-in-depth to minimize damage even in the event of an intrusion and reviewing the external connection environment. Please refer to the figure below.

Challenges in Government Security and Future Measures to Prevent Recurrence

Time Lag Until Incident Disclosure and the Reality of External Disclosure

Regarding the approximately two-and-a-half-month period it took from the anomaly detection on June 25, 2026, to the confirmation of the intrusion on July 9, and finally the final disclosure on September 11, debates arose concerning the promptness of information disclosure. At a press conference, Digital Minister Matsumoto explained that it was difficult to determine at the initial stage of detection whether the activity constituted legitimate operations or suspicious access, thus requiring time for factual verification. He also stated that disclosing details mid-investigation risked revealing investigative capabilities and tactics to attackers, leading to the decision to make the public announcement only after confirming concrete facts and identifying the affected parties. According to a survey on the actual state of cyber incident disclosures by domestic private companies (PwC survey), the median number of days from detection to initial disclosure is 5 days, with approximately 55 percent of organizations making disclosures within one week. Meanwhile, it has also been observed that disclosures tend to be prolonged when forensic investigations or the identification of affected individuals for personal information take time. The Act on the Protection of Personal Information requires prompt reporting upon detecting the risk of a data leak, and the Digital Agency had submitted an initial report to the Personal Information Protection Commission on July 15. Although the response prioritized damage prevention measures and the careful identification of the damage scope, it once again underscored the difficulty of administrative incident disclosure regarding how to strike a balance between ensuring social transparency and maintaining promptness.

Shifting to Practical Risk-Based Vulnerability Management and Its Impact on Society

In response to this incident, the Digital Agency has decided to fundamentally review its vulnerability management processes and continuously revise its recurrence prevention measures. The agency plans to shift from the conventional, passive approach of relying on vendor-published scores to a “prompt and proactive response based on actual risk,” taking into account the criticality of government information systems and the automation and sophistication of actual attacks. The revised government guidelines also explicitly state that when prompt patch application is necessary, priority must be given to addressing the issue—even if it means temporarily suspending system operations rather than waiting for scheduled maintenance. This policy shift will force not only government agencies, but also private IT vendors contracted to operate government systems and the entire IT supply chain to raise their security standards. The elimination of management deficiencies and insider threat risks at contractors and subcontractors, the thorough implementation of multi-factor authentication, and the acceleration of vulnerability information collection and evaluation processes are expected to be strictly enforced as future procurement requirements and operational specifications. This incident, which occurred in the GSS—the nation’s core business IT environment—strongly underscores the need to continuously review zero-trust operations in the face of increasingly sophisticated cyber threats and to elevate security standards across the entire supply chain.

Reference page

• [Q&A regarding “Potential Leak of Personal Information of Officials and Others Due to Unauthorized Access to the Government Solution Service” – Digital Agency] https://www.digital.go.jp/press/5fc99139-a4e2-4b7b-8b0c-d475e926143f
• [Status of Processing Reports on Data Breaches, etc., in the Third Quarter of Fiscal 2025 – Personal Information Protection Commission] https://www.ppc.go.jp/

[#DigitalAgency #GSS #UnauthorizedAccess #CyberSecurity #VulnerabilityMitigation #ZeroTrust #PersonalInformationLeak]