Digital Agency: unauthorized access to the Government Solution Service

On 11 September, the Digital Agency said its Government Solution Service (GSS), the shared platform used by ministries, had been accessed and files containing personal data may have leaked. On 25 June it detected mass file access through a maintenance operator's account, and on 9 July found that an outsider had got in by exploiting a VPN device vulnerability. The vulnerability was already public and was exploited before the patch was applied. About 246,000 records of ministry staff and contractors, with names, emails, phone numbers and addresses, may be affected; no members of the public or My Number data were included. Government work was not disrupted.