TOKYO — Japan’s Digital Agency has disclosed that approximately 246,000 personal data records were potentially compromised following an unauthorized network intrusion into its government administrative systems.
According to reports citing national news agency Kyodo, the affected records primarily include the full names and residential addresses of central government ministry personnel. Japanese authorities confirmed that there is currently no evidence indicating that the exposed information has been weaponized or leaked onto public underground forums.
Forensic investigations revealed that the initial unauthorized entry was detected on June 25, while subsequent threat hunting activity traced the intrusion back to late May. The threat actors gained initial access by compromising a legitimate account assigned to an external technical contractor responsible for operational maintenance and systems support.
Following the confirmation of unauthorized access, the Digital Agency immediately suspended the compromised maintenance credentials, launched internal containment protocols, and initiated forensic reviews to audit lateral movements within the network environment.
The agency issued a public apology regarding the security failure, stating that it is executing an immediate overhaul of its identity access management, multi factor authentication requirements, and privileged access monitoring frameworks to safeguard government databases against sophisticated supply chain and credential stuffing exploits.
The breach marks a high profile setback for Japan’s flagship Digital Agency, established in 2021 to centralize and modernize the country’s fragmented administrative IT infrastructure, lead national digital transformation, and establish standardized e government platforms.
