- Japan’s Digital Agency disclosed 246,000 records of government staff and contractors may have leaked from the shared GSS platform.
- No misuse is confirmed, but the exposed data is prime material for phishing and social engineering.
- The country already ranks among the world’s most-attacked.
One of the world’s most targeted nations, Japan, suffered its latest breach on Friday, September 11, as attackers stole around 246,000 personal data record sets from the country’s Digital Agency.
The hack exposed the names, email addresses and phone numbers of Japanese civil servants and contractors after an intruder got into a shared government network.
The Japanese agency insists that the exposed data has not turned up in any confirmed cases, which often range from phishing campaigns to violent attacks.
What did hackers leak in the Japan Digital Agency breach?
The hackers of the Japan Digital Agency stole government emails and personal phone numbers tied to real names from the common work Government Solution Service (GSS) platform used by ministries and agencies nationwide.
In terms of scale, it is smaller than the My Number-style incident that actually affected ordinary citizens.
By data type, the incident exposed 236,000 names, 231,000 email addresses, 94,000 phone numbers and 1,000 physical addresses.
How did hackers enter the Japanese database?
According to the Digital Agency disclosure, it detected unusual activity on June 25 after a maintenance and operations contractor account accessed a large number of files. The intrusion began in late May.
Weeks later, investigators fingered a VPN device vulnerability as the likely entry point. They said they had already suspended the account and cut the compromised equipment off from the outside network on the same day they shared the July 9 update.
France’s DGFiP tax authority was breached via a similar internal VPN compromise that, as Cryptopolitan reported.
Japan is a regular hack target
Japan is one of the ten most targeted countries in the world, per CloudSEK’s 2026 cybercrime report. Ironically, the Digital Agency it set up in 2021 to modernize and secure government IT, has now been breached.
In July, roughly 12.23 million email addresses and 7.61 million passwords were exposed in a confirmed KDDI breach.
Chinese hackers breached Japan’s National Center of Incident Readiness and Strategy for Cybersecurity in a 2023 attack suspected to have gone unnoticed data for months.
How hackers use leaked info to target crypto holders
There is a direct route from stolen data to attacks targeting crypto holders, as Telegram founder Pavel Durov called out a personal data leak at a French government apparatus after 41 crypto-linked kidnapping incidents were reported in the country within the first three and a half months of the year.
Chainalysis counted more than $30 million stolen in violent attacks in the first half of 2026, on track to pass 2025’s $58 million.
Analysts will be watching to see whether the 236,000 names and 231,000 emails in this breach turn up in any future exploits.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
How many people were affected by the Japan Digital Agency breach?
About 246,000 personal data records may have been exposed, split into roughly 189,000 tied to government staff and public servants and 57,000 tied to contractors and businesses.
How did hackers get into the government network?
An account belonging to a maintenance and operations contractor was used to access files, and investigators traced the entry point to a vulnerability in a VPN device by July 9. The account was suspended and the affected equipment was isolated.
Why does a government data leak matter for crypto users?
Leaked names, emails and phone numbers are used for phishing and social engineering, and Cryptopolitan has reported that stolen personal data has preceded kidnappings of crypto holders in France and phishing waves against hardware-wallet customers such as Trezor's.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
