KDDI Breach Exposes 14.2M Email Logins Across Six Japanese ISPs

Japanese telecommunications giant KDDI Corporation has disclosed a major data breach affecting up to 14.22 million email accounts across six domestic internet service providers. The company detected unauthorized access to one of its email systems on June 17 and immediately blocked the attacker, though the underlying vulnerability in an unnamed third-party software component had already been exploited. The incident impacts email services operated by STNet, JCOM Co., Chubu Telecommunications Co., NIFTY Corporation, and BIGLOBE Inc., all of which rely on KDDI's infrastructure.

KDDI, one of Japan's largest ISPs with 45,000 employees and $32.4 billion in annual revenue, revealed that the breached system may have exposed customer email addresses paired with passwords. The total figure includes current subscribers, former customers, and inactive accounts. While KDDI noted that some passwords were stored in hashed and/or encrypted form, the operator declined to specify the encryption standard used or what proportion of accounts retained plaintext credentials, leaving the actual credential-exposure risk unclear.

The compromised email system was used by five downstream ISPs, amplifying the blast radius well beyond KDDI's own customer base of millions. KDDI has since notified Japan's Personal Information Protection Commission and the Ministry of Internal Affairs and Communications, and is coordinating with the affected providers on additional hardening measures. The exploited third-party flaw highlights a recurring pattern of supply-chain exposure where one vendor's weakness cascades into partner networks.

Affected customers should reset their email passwords immediately and enable two-factor authentication wherever available. Users can verify whether their credentials appear in known exposures using an email breach checker and evaluate the strength of replacement passwords with a password checker. For a broader review of exposed personal data, a privacy checkup can help identify other accounts requiring immediate attention.