Digital Agency had not detected the VPN flaw before the attack

Assessment

Minister Matsumoto said this at the 11 September press conference, and the agency's own transcript corrects him inline: "had not been able to detect (correct: had been able to detect)". He went on to say the vulnerability was a known one, rated as not urgent, and that the hack happened while patching was in progress. The written Q&A confirms the flaw was published before the attack, the agency knew of it, and it was exploited before the fix was applied. Anyone quoting the spoken line gets the incident backwards.