Japan’s Digital Agency has discovered a data breach that may have exposed around 246,000 record rows containing personal information of government employees.

The agency says that the attacker gained initial access by exploiting a vulnerability in a VPN device used by the Government Solution Service (GSS).

An investigation started on June 25, after the agency detected a large-scale file access from the account of a maintenance and operations staff member.