246,000 exposed as hackers breach Japan's Digital Agency servers

One of the world’s most targeted nations, Japan, suffered its latest breach on Friday, September 11, as attackers stole around 246,000 personal data record sets from the country’s Digital Agency.

The hack exposed the names, email addresses and phone numbers of Japanese civil servants and contractors after an intruder got into a shared government network.

The Japanese agency insists that the exposed data has not turned up in any confirmed cases, which often range from phishing campaigns to violent attacks.

What did hackers leak in the Japan Digital Agency breach?

The hackers of the Japan Digital Agency stole government emails and personal phone numbers tied to real names from the common work Government Solution Service (GSS) platform used by ministries and agencies nationwide.

In terms of scale, it is smaller than the My Number-style incident that actually affected ordinary citizens.

By data type, the incident exposed 236,000 names, 231,000 email addresses, 94,000 phone numbers and 1,000 physical addresses. 

How did hackers enter the Japanese database? 

According to the Digital Agency disclosure, it detected unusual activity on June 25 after a maintenance and operations contractor account accessed a large number of files. The intrusion began in late May. 

Weeks later, investigators fingered a VPN device vulnerability as the likely entry point. They said they had already suspended the account and cut the compromised equipment off from the outside network on the same day they shared the July 9 update. 

France’s DGFiP tax authority was breached via a similar internal VPN compromise that, as Cryptopolitan reported. 

Japan is a regular hack target 

Japan is one of the ten most targeted countries in the world, per CloudSEK’s 2026 cybercrime report. Ironically, the Digital Agency it set up in 2021 to modernize and secure government IT, has now been breached.

In July, roughly 12.23 million email addresses and 7.61 million passwords were exposed in a confirmed KDDI breach. 

Chinese hackers breached Japan’s National Center of Incident Readiness and Strategy for Cybersecurity in a 2023 attack suspected to have gone unnoticed data for months.

How hackers use leaked info to target crypto holders

There is a direct route from stolen data to attacks targeting crypto holders, as Telegram founder Pavel Durov called out a personal data leak at a French government apparatus after 41 crypto-linked kidnapping incidents were reported in the country within the first three and a half months of the year.

Chainalysis counted more than $30 million stolen in violent attacks in the first half of 2026, on track to pass 2025’s $58 million.

Analysts will be watching to see whether the 236,000 names and 231,000 emails in this breach turn up in any future exploits.

If you're reading this, you’re already ahead. Stay there with our newsletter.