Japan's Digital Agency issued a notice yesterday: some of its websites built with the AI website-building platform Studio were breached by hackers, resulting in the leak of 13,323 pieces of private information.
The leaked data consists of the various inquiries that citizens submitted through web forms between 2021-5 and 2023-3. Broken down: approximately 8833 general opinions and suggestions, approximately 3661 inquiries related to vaccination certificates, approximately 462 workshop event information, approximately 250 recruitment inquiries, and even approximately 117 questions about borrowing the mascot "Mina-chan" costume suit.
What makes it trickier are the fields. The Digital Agency confirmed that the sender's name, email address, and message content were all leaked; some inquiry channels may also have exposed affiliated organizations, mailing addresses, and phone numbers. What was taken was not just messages, but multiple identity clues capable of pinpointing specific individuals.
No Secondary Damage Reported Yet
The good news is that, as of October 22, authorities have found no evidence that this information has been misused or caused secondary harm. However, the Digital Agency has raised the alarm: be wary of suspicious emails, phone calls, and text messages impersonating the agency or related organizations; do not casually click on links and attachments of unknown origin; and never fill in passwords or credit card information carelessly. Once someone uses the leaked information for targeted phishing, the risk shifts from "possible" to "happening now." Officials particularly stressed that they will never ask for passwords or other authentication information via email or phone.
The convenience of AI-built websites has, this time, become a security weakness. When low-barrier tools take on public-facing services for government agencies, the responsibilities for data and protection clearly can no longer be glossed over casually.