The agency said the incident involved servers under its control and that it was examining the scope of the intrusion, the information potentially affected and whether data had been taken outside its systems. The disclosure raises fresh questions over the security of government-held information as Japan expands digital public services and moves more administrative functions online.
Officials have not publicly identified the attacker or attributed the intrusion to any particular group. The agency has also not said that all of the information at risk was definitely extracted, describing the case as one in which personal data may have leaked. That distinction remains important while forensic work continues.
The potential exposure affects about 246,000 people, according to the agency’s disclosure. It was not immediately clear from publicly available information whether every affected record contained the same categories of personal information, or whether the figure represented individuals whose details were stored on systems that became accessible during the breach.
The agency is expected to determine the intrusion route, review access logs and identify the period during which unauthorised activity was possible. Such work is central to establishing whether attackers merely reached servers or copied information from them. No verified public finding has yet established who was responsible or whether the incident was financially motivated, espionage-related or connected to another cyber campaign.
Japan’s Digital Agency sits at the centre of the government’s effort to modernise public administration, standardise digital systems and support services linked to online identity, data exchange and government cloud infrastructure. The breach therefore carries significance beyond the number of people potentially affected because the agency is responsible for systems intended to improve the reliability and security of digital government.
The latest incident follows a separate personal-information problem disclosed by the agency in August. That case involved a login-history file from the National Qualifications Information Collaboration and Utilization System that contained names, user IDs and organisational codes belonging to 150 employees of qualification-management bodies. The agency said that disclosure resulted from an operational error caused by ambiguous work instructions, rather than an external cyberattack, and that the file had been deleted by the receiving organisation.
The agency has previously faced unauthorised access to infrastructure it operated. In September 2022, a mail relay server used by the G Biz ID business authentication service was accessed without permission and about 13,000 spam messages were sent during a roughly 30-minute period. The agency said at the time that it detected the abnormal activity, blocked the communication and found no personal-information leak linked to that event.
Those earlier cases differ materially from the current breach, which involves the possibility that information concerning roughly a quarter of a million people was exposed. The scale makes the outcome of the investigation especially important for assessing both the extent of the damage and whether additional security controls will be required.
Japan’s personal information framework requires public bodies to manage information appropriately and protect it against leakage, loss and damage.
The Personal Information Protection Commission, Japan’s independent privacy regulator, oversees compliance with the country’s data-protection law, including the handling of personal information by administrative bodies, and can seek reports or corrective action.
The Digital Agency’s own privacy policies state that collected information should be safeguarded through necessary security measures, including where operational work is entrusted to outside contractors.
The agency’s investigation will also need to establish whether individuals whose data may have been affected require direct notification and what protective steps, if any, they should take. That will depend on the type of information involved and whether investigators confirm that data was copied or otherwise removed from the compromised environment.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
