JAXA: data leakage from its 2023 intrusion confirmed in a July 2024 follow-up

The intrusion had become public by 29 November 2023, when Japan's chief cabinet secretary acknowledged it. On 5 July 2024 the Japan Aerospace Exploration Agency (JAXA) disclosed that data had leaked in an intrusion the year before. In October 2023 a report from an outside organization alerted it to unauthorized access to some servers on its business intranet. The intruder entered some servers and PCs through a vulnerability in a VPN device, spread further and stole account data, then used it to access Microsoft 365 posing as legitimate users. A previously disclosed vulnerability was very likely exploited, and several unknown malware strains made detection hard. Information for joint work with outside organizations and personal data, including that of JAXA staff, leaked. The affected systems did not handle sensitive information such as rocket or satellite operations. From January 2024 there were several further intrusion attempts, including a zero-day attack, without any leak; JAXA said all of them targeted VPN equipment.