KDDI Email Platform Breach Exposed 12.2 Million Addresses and 7.6 Million Passwords

KDDI disclosed that a cyberattack against an email platform it operates for five Japanese internet service providers exposed more than 12.2 million customer email addresses and 7.6 million passwords. The compromised system supported customer account management, webmail, and email storage, and the company said the intrusion was enabled by a vulnerability in third-party software used by the platform. KDDI initially reported the unauthorized access in June and later confirmed the scale of the breach after a forensic investigation and notification to Japan’s communications ministry.

The company said it patched the flaw and modified the affected system immediately after detecting the attack, adding that investigators found no evidence of compromise beyond exploitation of the vulnerable software. KDDI also said its own consumer email services for mobile and fixed-line internet customers run on separate infrastructure and were not affected. The incident has prompted affected ISPs to coordinate mandatory password resets for impacted users and underscored the risk that a single flaw in shared third-party software can cascade across multiple providers.