Japan's Digital Agency says VPN flaw exposed 246,000 personnel records
-
Japan's Digital Agency has disclosed a data breach affecting roughly 246,000 record rows containing personal information belonging to government employees. The exposure stemmed from a flaw in a VPN product used by the agency, which allowed unauthorized access to internal systems holding personnel data.
The agency has not publicly assigned a specific CVE identifier for the flaw in the information released so far, so the vulnerability should be tracked by the vendor advisory once it becomes available. Details on the exact VPN product and affected versions have also not been fully outlined in the disclosure.
Key points:
- Approximately 246,000 record rows may have been exposed
- The data involved personal information of government personnel
- The root cause was a VPN vulnerability
- The Digital Agency is continuing its investigation into the scope and impact
Personnel whose information may have been caught up in the incident should monitor for follow-up guidance from the agency, and administrators running similar VPN appliances should apply vendor patches as soon as they are released and review access logs for signs of exploitation.
Source: BleepingComputer
Does your organization run the same class of VPN appliance, and if so, have you already patched or begun hunting for signs of compromise?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login