KDDI breach hits email platform used by five Japanese ISPs

Japanese telecommunications company KDDI disclosed that attackers broke into an email platform shared by five domestic internet providers, exposing the addresses of 12,233,087 individuals along with the passwords of 7,616,173 others.

KDDI discovered the breach on June 17 after attackers exploited a zero-day vulnerability. The firm cut off the intruders the same day, rolled out protective steps, and first went public with the matter last month. A July 6 update established that the intrusion started on May 16 through an unrecognized flaw in third-party software.

"As a result of our investigation, as of June 17, 2026, the date of our confirmation, this vulnerability was not recognized by the software vendor," KDDI said. "The software vendor has reported this vulnerability to public authorities and is working toward disclosing the information." A forensic review completed on June 23 verified that the exploited flaw had been fixed and that no additional problems existed in the environment. The operator has since installed Endpoint Detection and Response tools to catch future intrusion attempts.

The breach affected customers of five ISPs including STNet, JCOM, Chubu Telecommunications, NIFTY Corporation, and BIGLOBE. KDDI, the second-largest mobile carrier in Japan with 45,000 employees and annual revenue of $32.4 billion, initially reported that as many as 14.22 million current and former users plus dormant accounts could be involved. Confirmed numbers show email addresses for more than 12.2 million people and passwords for roughly 7.6 million.

Some of the exposed credentials had been kept in hashed or encrypted format, although the company gave no breakdown of how many remained in plain text or which encryption method was applied. KDDI has informed Japan's Personal Information Protection Commission and the Ministry of Internal Affairs and Communications. No confirmed follow-on misuse has surfaced.

KDDI is now forcing password changes across affected accounts within one or two days. Many frequent users have already reset their credentials, while the firm is coordinating with the partner ISPs to enforce mandatory updates for infrequent users within the next day or two.