Japanese telecoms giant KDDI says 12 million emails exposed in major cyberattack

KDDI confirms unauthorized access affecting six ISPs, with up to 14.22 million email addresses and passwords exposed
Some passwords were not encrypted; with estimates citing 12.2 million emails and 7.6 million passwords compromised
The company called for timely password updates, coordinated countermeasures with ISPs and committed to preventing recurrence.

KDDI, one of Japan’s largest telecommunications providers, has confirmed that it was recently hacked and lost millions of unencrypted emails and passwords belonging to its customers’ customers.

In a data breach notice, shared last month, the company said it confirmed “unauthorized access” on June 17, 2026.

“As a result, part of the information from the messaging services offered by these ISPs may have been disclosed externally,” reads a machine translation of the notice.

Coordinate countermeasures

The incident reportedly affected an email system used by KDDI to manage customer email accounts, webmail and email storage.

KDDI says the attack affected six ISPs: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty Corp and BIGLOBE. Up to 14.22 million email addresses and passwords linked to these mailboxes were allegedly exposed, including accounts of former customers as well as dormant users.

“Some” passwords were hashed or encrypted, the company added, suggesting others were not. He also said the 14.22 million figure represents a “maximum estimate” and that the investigation is still ongoing. The Record reported 12.2 million customer email addresses and 7.6 million passwords exposed.

Since spotting the intrusion on June 17, KDDI has contacted ISPs to “coordinate countermeasures” and urged their customers to update their passwords as soon as possible. “Customers should promptly follow the instructions provided by their ISP,” it says. “KDDI will continue to work with ISPs to inform customers and support rapid password updates. » It also says that “many customers” have already updated their passwords.

“We are analyzing the extent of the impact and the cause, responding to customers in coordination with ISP operators and taking measures to prevent a recurrence,” the company said.

KDDI is one of Japan’s largest telecommunications companies, rivaling NTT Docomo and SoftBank. It serves around 72 million mobile subscribers.

Via The file