KDDI Says Breach Exposed 14.2 Million Managed Email Accounts

KDDI disclosed unauthorized access to an email platform it operates for itself and multiple Japanese internet service providers, warning that up to 14.22 million email account records may have been exposed. The affected service supports KDDI and providers including STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and BIGLOBE. KDDI said the intrusion was detected on June 17 and linked to exploitation of a vulnerability in third-party software used by the system, after which it blocked further access and added defensive measures.

The potentially exposed data includes email addresses, passwords, and some personal information tied to active, dormant, and canceled accounts. KDDI said the password data was hashed or encrypted, but it has not publicly clarified the protection status or algorithms for all records, and the full scope of the incident remains under investigation. The company reported the breach to Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications, and is coordinating customer notifications and password resets with the affected ISPs.