My Number

2023: Project Challenges

On June 30, 2023, the Ministry of Internal Affairs and Communications of Japan reported serious security problems with the Fujitsu Fenics cloud platform, which is used by government agencies and corporations. In addition, failures were identified when working with Japanese My Number identifiers, which Fujitsu is responsible for issuing.

My Number is a system of digital identity cards that are issued in Japan to local citizens and residents for various government services. However, the operation of the system is fraught with numerous problems. In particular, citizens often receive identifiers with the data of other people. Failures were recorded in Yokohama, Kawasaki and Tokyo's Adati district. Prime Minister Fumio Kishida said the situation undermines public confidence in public digital services, as the My Number platform leads to personal data leaks. As a result, Fujitsu was forced to disable the system for issuing official documents ordered using My Number, and Kisida ordered an emergency check of the platform.

Found malfunctions with Japanese My Number IDs, for which Fujitsu is responsible

It is also reported that in the period from March 2022 to November of the same year, several data leaks occurred through Fenics. At least 1,700 companies and government organizations were affected. However, Fujitsu was able to detect the problem only in December 2022, that is, about eight months after the first hack.

We have found that there are serious problems with security measures, the control mechanism and risk management. It is extremely regrettable that there have been numerous data breaches, the Japanese Ministry of Interior and Communications said.

The problem is related to incorrect settings of the network equipment that is used to keep Fenics running. At the same time, Fujitsu for some reason for a long time could not detect unauthorized access to its systems. As a result, a large amount of confidential information was stolen. At the same time, Fenics is part of the Japanese Information System Security Management and Assessment (ISMAP) program, which analyzes the security of cloud services.

It is noted that Fujitsu develops many services for government agencies and critical infrastructure. The attacks on the Fenics platform suspect cybercriminal groups associated with the Chinese government. Japanese authorities are calling on the company to strengthen security measures, warning of liability for damage caused by data leaks.^[1]

Notes