Japan's largest telecom operator KDDI Corporation disclosed a data breach affecting a shared email platform used by six internet service providers, potentially exposing the login credentials of up to 14.2 million customers. KDDI detected unauthorized access on June 17 after attackers exploited a vulnerability in unnamed third-party software, then blocked the intruders and notified Japanese regulators.
The affected providers — STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE — span current, former, and inactive accounts. Exposed data includes email addresses and passwords, some of which were hashed, KDDI said.
KDDI has urged customers to reset their passwords immediately and enable two-factor authentication where available. The breach is one of the largest disclosed by a Japanese telecom in recent years, highlighting growing risks tied to shared third-party infrastructure across ISPs.