Unauthorized Access to Japan's Government Solution Service (GSS) Exposes 246,000 Personal Records via VPN Flaw
Japan's Digital Agency has disclosed that its Government Solution Service (GSS) was compromised through unauthorized access that exploited a vulnerability in VPN equipment used for remote maintenance.
Attackers gained entry by targeting the VPN device employed for external support operations, leading to the compromise of maintenance accounts. Evidence indicates the intrusion began around late May 2026.
On June 25, 2026, monitoring systems detected unusual activity when a compromised account accessed a large number of files stored on GSS servers. Subsequent investigation with external partners confirmed the breach on July 9.
Some files may have been exfiltrated, potentially exposing 246,000 personal records. These include approximately 189,000 entries related to staff from related agencies and civil servants, plus 57,000 records concerning businesses and individuals involved in associated operations. The data encompasses names, email addresses, telephone numbers, and residential addresses collected during official duties.
The agency responded on July 9 by disabling the compromised accounts and blocking all external communications. Specific details about the VPN vulnerability remain undisclosed.
Related articles
Metascan Confirms Limited Data Breach After Two-Minute Telegram Bot Compromise
Metascan has publicly acknowledged a data breach involving internal materials obtained through a compromised Telegram bot token. The attacker gained access to a corporate Telegram chat for approximately two minutes on September 5 and exported a small set of documents before being removed. The incident stemmed from an overlooked bot token on test virtual machines after an employee departure. Among the leaked items were two pilot project reports from July 2026 that mentioned major Russian organizations including Transneft, Selectel, Lenta, Sberbank, and Rostelecom. Metascan attributed the leak to a former employee now working with a competitor and rejected claims of deliberately hidden vulnerabilities. The company has accepted full responsibility, outlined corrective measures, and launched a bug bounty program.
South Korean Medical Beauty Platform Gangnam Unni Suffers API Breach Exposing 220,000 Users' Sensitive Photos and Medical Records
Healing Paper, operator of South Korea's largest medical beauty information platform Gangnam Unni, confirmed a data breach affecting nearly 220,000 customers after an API endpoint used to query consultation records was abnormally accessed. The incident exposed highly sensitive personal information including names, contact details, medical consultation reasons, treatment progress, uploaded pre-procedure photos, appointment times, actual procedures performed, and payment information. Approximately 160,000 South Korean users and 60,000 overseas users were impacted, including 481 from mainland China, 4,218 from Taiwan, and others from Japan and Thailand. Attackers exploited weak authentication and rate limiting on the API, first detected on September 4, with a second attempt on a different path the following day. The breach raises risks of targeted phishing and extortion using victims' private medical images and records. Healing Paper has reported the incident to authorities, implemented enhanced authentication and monitoring, and allowed users to check their exposure status within 30 days.
Dropbox Accounts Compromised Through Lenovo ID Authentication Flaw
Several thousand Dropbox accounts were breached between August 4 and 21 due to an authorization flaw involving Lenovo ID. The root cause was an error on Lenovo's side that permitted registration of accounts using arbitrary email addresses, which could then be used to access matching Dropbox accounts. Dropbox responded by forcing logouts for all users who had relied on Lenovo ID and by requiring direct password entry for Dropbox credentials. Approximately 5,000 accounts were affected, though only about one-third saw stored files accessed by attackers. Accounts protected by two-factor authentication remained unaffected. Additional reports from the same period covered Kaspersky analysis of ValleyRAT spyware using DLL sideloading, a critical SQL injection vulnerability in the All-in-One WP Migration WordPress plugin, and a Google Chrome update addressing CVE-2026-85046 in the V8 engine.
Detecting and Removing Secrets from Git History with Betterleaks and git-filter-repo
Developers often accidentally commit sensitive data such as API keys, passwords, database dumps, or private uploads to Git repositories. Even after removal in a later commit, these secrets remain accessible in the commit history and can be recovered by anyone with repository access. The recommended approach begins with scanning the entire history using specialized tools to identify leaked credentials across all branches and past commits. Once identified, the secrets must first be rotated or revoked before any history rewriting occurs. Tools like Betterleaks provide detection with keyword filtering, entropy analysis, and Base64 decoding, while git-filter-repo enables precise removal of files and replacement of secret strings throughout the repository timeline. The process requires careful backups, coordination with teams, and force-pushing rewritten history, followed by fresh clones for all contributors and CI/CD systems. Even after cleanup, organizations must assume that old secrets may persist in forks, backups, or caches and therefore treat rotation as mandatory.