KDDI Data Breach Exposes Up to 14.2 Million Email Logins Across Six Japanese ISPs After Third-Party Software Zero-Day

Overview

Japanese telecommunications company KDDI has disclosed a data breach in the shared email platform it operates for a group of internet service providers, an incident that in its worst case could involve up to 14.2 million email logins, according to BleepingComputer. KDDI discovered the compromise on June 17, 2026, and responded the same day by blocking the attacker and implementing defensive measures, as reported by BleepingComputer.

What We Know

KDDI’s investigation determined that the attackers exploited a vulnerability in an unnamed third-party software used on its email system, according to BleepingComputer. Infosecurity Magazine likewise reported that the unauthorized actor exploited a vulnerability in third-party software used in the email system. KDDI stated that as of June 17, the date it confirmed the incident, the flaw was not yet recognized by the software vendor — indicating a zero-day — and that the intrusion itself occurred on May 16, according to BleepingComputer.

The worst-case exposure spans up to 14.22 million email addresses and passwords, as reported by Infosecurity Magazine. A subsequent update narrowed the confirmed scope to 12,233,087 email addresses and 7,616,173 passwords, according to BleepingComputer. The affected accounts include current, former, and inactive customers, as reported by BleepingComputer.

The breach touched email services delivered through six ISPs: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty Corporation, and Biglobe, according to Infosecurity Magazine. Security Affairs reported that some of the exposed passwords were stored in hashed and/or encrypted form, meaning they cannot be readily abused for account takeovers even if leaked.

KDDI notified Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications, according to Security Affairs. The company has urged affected users to reset their passwords and to enable two-factor authentication where available, as reported by BleepingComputer, and Infosecurity Magazine reported that KDDI strongly advised customers of the affected services to change their passwords.

What We Don’t Know

KDDI did not specify what type of encryption was used or what percentage of accounts had passwords stored in plaintext, according to BleepingComputer. The identity and motive of the attackers have not been disclosed, and the headline figures remain worst-case estimates that KDDI has described as subject to ongoing investigation, as reported by Infosecurity Magazine.

Analysis

The KDDI incident underscores a recurring risk in telecommunications and hosting: a single vulnerable component in a shared platform can expose credentials across many downstream brands at once. Because the flawed software served email for multiple ISPs simultaneously, the blast radius extended well beyond KDDI’s own customer base to partner providers that relied on the same infrastructure. The partial use of hashed or encrypted password storage, per Security Affairs, limits the immediate value of the stolen data, but the scale of exposed email addresses still raises the prospect of targeted phishing against affected users.