The GSS intrusion began in late May 2026
Assessment
Security NEXT reports the system "appears to have been intruded from around late May". None of the agency's three published documents — the announcement, the Q&A and the minister's transcript — gives a start date; the earliest date on the record is the 25 June detection of mass file access. The late-May figure is plausible as a detail from the reporters' briefing but has no written source, and the agency has since had two updates in which to state it and has not.
Where this claim appeared
Security NEXT · 2026-09-11
https://www.security-next.com/190208What “Weak Evidence” means
Evidence exists but is thin, circumstantial, or explicitly qualified as weak by the source that published it. Shared hosting infrastructure between threat clusters is the recurring example.
3 of 5 · rating scale
Assessed in
Japan Digital Agency GSS breach: a known VPN flaw, a contractor account and 246,000 records on a zero-trust networkThink this assessment is wrong? Report an error.