Digital Agency reports data breach via website vendor

The Digital Agency, the government office responsible for the country’s digitization efforts and digital infrastructure, said Friday that more than 13,000 user profiles may have been affected in a data breach via a vendor responsible for overseeing parts of its website.

At a news conference on Friday, digital minister Toshiharu Furukawa confirmed the unauthorized access of Studio Co.’s website, which contained data originally collected by the Digital Agency between 2021 and 2023.

The profiles include names and email addresses, with some accounts possibly including telephone numbers and delivery addresses.

On Oct. 16, Studio Co. reported that a third party had “illegally accessed its cloud environment and enabled data in the environment to be acquired from external sources.” The breach took place between Sept. 30 and Oct. 1 and was confirmed by the company on Oct. 13. The breach was not publicly reported until Oct. 16, when the Digital Agency was also informed.

The Digital Agency acknowledged the breach on Thursday, citing its own process of investigation as the cause for the delay.

“At this time, we have not confirmed any secondary damage, such as the misuse of leaked personal data. However, please be careful of suspicious e-mails, phone calls and texts pretending to be from Digital Agency or related organizations,” the Digital Agency said in a statement on Thursday.

This is not the first time the Digital Agency — which offers governmental guidance on cybersecurity protection — has faced a breach of its own data. Unauthorized access was also revealed on Sept. 11, affecting the Government Solution Service — an infrastructure network for the government — and leading to the leaking of names and email addresses of government employees.