246,000 personal records were leaked from Japan's GSS
Assessment
The agency says the records "may have been" leaked, and its Q&A explains the number deliberately includes every record for which leakage cannot be ruled out among files with traces of unauthorised access. It is an upper bound chosen to err toward notifying people, not a count of exfiltrated data. The agency has not said how many files it can confirm left the system. Headlines that drop the qualifier report a certainty the agency has not claimed.
Where this claim appeared
BleepingComputer · 2026-09-14
https://www.bleepingcomputer.com/news/security/japans-digital-agency-says-vpn-flaw-exposed-246-000-personnel-records/What “Assessed, Not Confirmed” means
A named source states this as its own assessment, at its own stated confidence, rather than as established fact. Attribution to a nation state usually sits here. The assessment is real and reportable; treating it as settled is the error.
4 of 5 · rating scale
Assessed in
Japan Digital Agency GSS breach: a known VPN flaw, a contractor account and 246,000 records on a zero-trust networkThink this assessment is wrong? Report an error.