Japan’s Zero Trust Government Trusted a Vulnerable VPN -By Fransiscus Nanga Roka

Japan Established a New Digital Agency to Modernise Government Deep down its latest cyberattack reveals something that is painfully archaic: an unprotected gateway, the administrative rights all too generous and a bureaucracy that took two weeks to determine how a breach made it into one of the country´s most sensitive common networks.

Digital Minister Takeaki Matsumoto announced on September 11, 2026 that it had found out that around 246,000 personal records may have been leaked from the Government Solution Service or GSS. The network ties together 23 key central ministries and agencies, including, reportedly, the Agriculture Ministry and Imperial Household Agency.

But about the who, what and where are troubling. About 189,000 government and related public-sector employees are affected as well as 57,000 contractors and others working within GSS institutions. Compromised data includes approximately 236,000 names, 231,000 email addresses,94,000 telephone numbers and 1,000 home address. However, the Digital Agency said My Number identifiers as well as bank-account and pension numbers were excluded.

The when and how reveals the deeper failure.

An external attacker gained access via a flaw in virtual-private-network gear and exploited a maintenance-and-operations account to obtain far more server files than he should have been able to. The agency noticed the unusual activity on June 25. It wasn’t until July 9 that investigators confirmed the VPN breach, shut down the breached account and sealed off communications between infected devices and outside systems. Followed by public disclosure, was more than two months later.

No secondary abuse has been detected administrative. But, lack of evidence for abuse is not equal to safety. A directory of officials, contractors and their institutional email addresses telephone numbers and physical addresses is bespoke intelligence for spear-phishing impersonation coercion and espionage. From stolen organizational relationships an upcoming attack may not look different from other government emails.

The why is institutional complacency dressed in fine language. GSS was marketed as zero-trust infrastructure for secure remote work in 2023. But zero trust is not a slogan you buy with new software. Requires continual authentication, least-privilege access, network segmentation, behavioral monitoring and immediate containment of activity that appears out of the ordinary.

If a single compromised maintenance account somehow had access to all the files across ubiquitous shared infrastructure, well that was not zero trust in action. That was concentrating trust and thus concentrating disaster.

First of all, Japan should be ordered to conduct an independent forensic investigation and disclose (i) when the vulnerability became known; (ii) why remediation was not completed before exploitation; (iii) what data was irretrievably removed; and (iv)? who authorized continued operation? The excuse of “national security” must not become a bureaucratic cover for preventable negligence.

Second, its all-too-easy to connect privileged accounts while needing hardware authentication resistant to phish devices and only just in time authorization whenever access extends throughout an administrators working guidelines without automatically halting any violations. Contractors should never have permanent, system-wide scopes of access.

Third, Japan requires legally binding patch deadlines for government equipment that is on the Internet. If this is not possible, then the impacted service should be isolated when a critical vulnerability cannot immediately be patched. An exposed VPN is not a maintenance headache, it is an unlocked governmental entrance.

Fourth, there should be an independent regulator auditing each institution connected to the GSS, overseeing notifications of breaches at the level of individual person and monitoring rapidly whether exposed information is weaponised. Parliament must determine whether the delay between detection and confirmation, followed by a disclosure time line, was in accordance with Japan’s obligations under privacy and public accountability laws.

Lastly, the government should make breach simulations mandatory for all ministries. Zero trust is slain not by documentation claiming a zero trust architecture in procurement documents but through rigorous testing under hostile conditions.

It does not mean that zero trust failed in this case. This shows that Japan’s government can talk about zero trust, but go on trusting weak equipment, strong accounts and bureaucratic slow kill.

A state cannot be digital trust while accountability is analog.

Fransiscus Nanga Roka

Faculty of Law University 17 August 1945 Surabaya and managing Partner Law Firm Victorious Indonesia