Japan's Digital Agency, the government office that runs the country's digitization program and publishes cybersecurity guidance for other agencies, has confirmed a data breach at Studio Co., Ltd., the outside company it uses to run parts of its website. An attacker got into Studio's cloud environment and may have taken personal data that people submitted through the agency's web forms between May 2021 and March 2023. The agency's own notice, published October 22, lists the affected data by form. Those counts add up to roughly 12,900 messages before the final category, which was cut off in the copy we reviewed. The Japan Times reports that "more than 13,000 user profiles" may have been affected, which fits that total. Digital minister Toshiharu Furukawa confirmed the breach at a news conference on October 23. This is the agency's second disclosed breach in six weeks. On September 11 it reported that attackers had used a VPN flaw to break into its Government Solution Service (GSS) network, potentially exposing about 246,000 personnel records.
What Happened
The Digital Agency's October 22 notice says Studio confirmed on October 16 that "a third party had illegally accessed its cloud environment and enabled data in the environment to be acquired from external sources." The agency says it is still working out the full scope.
The Japan Times gives a more detailed timeline that does not appear in the agency's notice:
- September 30 to October 1: the unauthorized access took place.
- October 13: Studio confirmed the breach internally.
- October 16: Studio disclosed the breach publicly and informed the Digital Agency.
- October 22: the Digital Agency published its own notice. According to the Japan Times, the agency blamed the six-day gap on its own investigation process.
These dates come from a single OTHER-tier outlet, and the agency's notice confirms only the October 16 date. Treat the others as reported, not confirmed. On the agency's notice, October 16 is the date Studio confirmed the access. The Japan Times instead puts Studio's internal confirmation on October 13 and calls October 16 the public disclosure.
The September GSS breach is a separate incident with a different cause. Accounts of it are consistent across BleepingComputer, Bloomberg, The Star, ThreatPaper and CTI Pilot. The attacker exploited a vulnerability in a VPN appliance used for external maintenance access, starting in late May according to The Star and Piyolog as cited by CTI Pilot. On June 25 the agency spotted an unusually large volume of file access from a maintenance and operations contractor's account. On July 9 it traced the entry point to the VPN flaw, suspended the account and cut the device off from external connections. It disclosed the breach on September 11.
One discrepancy across the two incidents: The Star names the digital minister who announced the GSS breach in September as Hisashi Matsumoto, while the Japan Times names Toshiharu Furukawa as minister in October. That may reflect a cabinet change between the two dates, but none of the sources addresses it.
What Was Taken
Studio vendor breach (October). The agency's notice lists the data that may have leaked from its website inquiry forms. All entries date from May 2021 to March 2023:
| Form | Max. messages | Data fields |
|---|---|---|
| General comments and requests | 8,833 | Name, email, inquiry content |
| Employment inquiries | 250 | Name, email, phone number, inquiry content |
| Vaccination certificate app inquiries | 3,661 | Name, email, inquiry content |
| Myna-chan costume rental requests | 117 | Name, email, affiliation, delivery address, phone number |
| Workshops and other participation forms | Not given in the copy reviewed | Not given in the copy reviewed |
The agency notes that names and email addresses were optional on these forms, so some records contain only the text of the inquiry. The Japan Times summarizes the data as names and email addresses, with phone numbers and delivery addresses in some records. The agency says it has found no misuse of the data so far.
GSS breach (September). The sources broadly agree on about 246,000 records of government personnel data. BleepingComputer and CTI Pilot break that down as about 236,000 names, 231,000 email addresses, 94,000 phone numbers and 1,000 physical addresses, with overlap between fields. By population, The Star and ThreatPaper split it into about 189,000 records of staff at agencies and independent administrative agencies that use GSS, and about 57,000 records of businesses and individuals who work with them. Every source agrees that no data on the general public, My Number ID numbers, bank account details or pension numbers was involved.
The sources disagree on how many people use GSS. ThreatPaper cites about 53,000 officials across 18 organizations as of February 2026. The Star, citing the agency, reports about 154,000 users across 23 organizations as of the end of July. The two figures may reflect the network's rapid expansion between those dates.
Why It Matters
- Unexpected data in the vendor's hands. The vendor breach exposed data that most people would not expect a web hosting vendor to hold: inquiry records from the agency's early days, including from the period when the Preparatory Office for Digital Reform-related Bills was still running. The vaccination certificate app inquiries in particular tie people to a public-health service. Data that was collected years ago and never deleted, then held by a vendor, is a common way small breaches turn into incidents involving a government body.
- Repeated hits on the agency setting the standard. The Digital Agency sets digital standards and issues cybersecurity guidance for other government bodies. Two disclosed breaches in six weeks will draw attention to how it manages its contractors. In the GSS case, the attacker came in through a contractor's maintenance access. In the Studio case, the failure was at the outside company itself. In both, the exposure came from a third party with privileged access, not from the agency's own core systems.
- Part of a wider wave. @IT describes September 2026 as Japan's "cursed September," a month that also brought disclosures from Times Car (about 6.6M accounts), Sakura Internet (up to 1,360,563 accounts), Seicomart, Gyazo and Japan Post. @IT suggests that attackers using AI agents to speed up their operations may explain the cluster. That is the outlet's hypothesis, not a finding, and none of the sources links it to either Digital Agency incident.
- Phishing risk. The leaked names and email addresses are tied to government inquiries. That makes them useful for convincing phishing messages that pretend to be from the Digital Agency, which is exactly what the agency is warning about.
The Attack Technique
Studio breach: Nobody has said how the attacker got into Studio's cloud environment. The only description so far is that data in the environment was "enabled to be acquired from external sources." That wording could mean a misconfiguration that exposed data publicly, stolen credentials, or a deeper intrusion, and the sources do not say which. No threat actor has been named, and there are no indicators of compromise (IOCs) or claims of responsibility.
GSS breach: The attacker exploited a known, already-published vulnerability in a VPN appliance used for external maintenance access. Per BleepingComputer, the agency's Q&A says it was not a zero-day and had a Medium severity rating. According to ThreatPaper, the agency says it was patching the flaw faster than it normally would for a Medium-rated issue, but the attacker got there first. The Star's wording describes the attack as a "bypass" of the VPN. Neither the VPN product nor the CVE has been disclosed. Once inside, the attacker used a maintenance contractor's account to read a large number of files on a server. The VPN exploit itself was not detected. The breach surfaced only when the agency's monitoring flagged the mass file access, roughly a month after the intrusion began, and it took another two weeks to trace the entry point.
What Organizations Should Do
- Inventory data held by vendors. List every outside provider that hosts forms, CMS content or cloud storage for you, and find out what personal data they still keep. Require that old inquiry records be deleted on a fixed schedule, not kept indefinitely.
- Require breach notification deadlines in vendor contracts. In the reported timeline, about two weeks passed between the intrusion and the agency learning of it. Contracts should require prompt notification after a breach is confirmed, and you should rehearse your own process for issuing a public notice after hearing from a vendor.
- Patch edge devices on exposure, not on the severity score. The GSS flaw was rated Medium and had already been published. Any internet-facing VPN or remote-access appliance should be patched on an emergency timeline, whatever its CVSS rating.
- Lock down contractor maintenance accounts. Give maintenance accounts the least access they need, require phishing-resistant MFA, make access time-limited or just-in-time, and alert on unusual file-access volume. That last control is what eventually caught the GSS intrusion.
- Monitor what happens after login, not just the perimeter. Alerts on mass file reads, unusual data egress and abnormal activity in cloud storage catch intrusions that bypass the perimeter. Aim to shorten the gap between detection and identifying the root cause.
- Warn affected users early. If contact data leaks, tell users quickly through the channels they already trust. Make clear that you will never ask for passwords or payment details by email or phone, as the Digital Agency has done.
Sources: Digital Agency reports data breach via website vendor - The Japan T... | Japan's Digital Agency says VPN flaw exposed ... | Japan’s Digital Agency Hit by Unauthorized Access to Servers - Bloo... | About the possibility of personal information leakage due to unauth... | Japan Digital Agency GSS breach: a known VPN flaw, a contractor acc... | Japan's Digital Agency: a VPN vulnerability exploited since May wen... | タイムズ、デジタル庁、不正アクセス続出の“魔の9月” 一連の背景にはAIの悪用？：相次ぐ不正アクセス被害の理由は - ＠IT | Japan government system hit by cyberattack; 246,000 personal record...