KDDI Confirms Breach Exposed 12.2 Million Emails and 7.6 Million Passwords

KDDI, one of Japan's three largest telecommunications companies, confirmed Monday that a cyberattack on an email platform it operates exposed more than 12.2 million customer email addresses and 7.6 million passwords. The company had first disclosed unauthorized access back in June, but only nailed down the full scope of the damage this week, after wrapping up a forensic investigation and filing a report with Japan's communications ministry.

The compromised system wasn't KDDI's own consumer email service. It was a shared email platform the company runs on behalf of five Japanese internet service providers, handling account management, webmail, and storage for their customers. KDDI said its mobile and fixed-line consumer email runs on entirely separate infrastructure and was never touched.

According to KDDI, the attackers got in by exploiting a vulnerability in third-party software underpinning the email platform. The company says it patched the flaw and reconfigured the system as soon as it detected the intrusion, and that its investigators found no evidence the attackers moved beyond that initial exploited weakness into other systems.

The company is now leaning on the affected ISPs to push mandatory password resets. "So far, many customers who use the email service regularly have changed their passwords," KDDI said, adding that the ISPs are working to complete the reset process for remaining users in the coming days. In a statement, the company said it is "analyzing the scope of the impact and the cause, responding to customers in coordination with ISP operators, and taking measures to prevent a recurrence."

A telecom giant with a wide footprint

The scale of this incident is worth sitting with. KDDI isn't a niche provider — it runs Japan's second-largest mobile network and also sells broadband, cloud computing, cybersecurity, and data center services. A breach touching 12.2 million email addresses run through infrastructure it manages for other ISPs shows how a single vulnerability in shared backend software can ripple outward to affect customers who may not even know KDDI is involved in their email service at all.

That's a structural risk a lot of consumers don't think about: you sign up for internet service with one company, but the email account, webmail portal, or storage tied to that account may run on infrastructure operated by a completely different provider, often one you've never heard of. When that infrastructure gets hit, the damage spreads across every ISP relying on it, which is exactly what happened here across five separate providers.

Part of a busier-than-usual stretch for Japanese firms

KDDI's disclosure lands amid a run of cybersecurity incidents hitting major Japanese companies in recent weeks. The Japanese unit of insurer Aflac, electronics manufacturer Nidec, and brewer Sapporo Holdings have all reported breaches or cyber-related disruptions recently. There's no indication these incidents are connected to each other or to the KDDI breach, but the clustering has put a spotlight on how Japanese corporations are handling security incident response and disclosure.

Separately, and unrelated to the KDDI case, Tokyo police this week arrested a 15-year-old high school student accused of exploiting a vulnerability in the servers of anime streaming service Bandai Channel to fraudulently cancel more than 46,000 user subscriptions. It's a reminder that not every high-impact security incident in Japan right now involves a nation-state actor or organized ransomware crew — sometimes it's a teenager poking at a poorly secured server.

For KDDI's part, the company says the immediate technical fix is done: the vulnerability is patched, the system modified, and password resets underway across the affected ISPs. What remains is the slower work of rebuilding confidence with millions of customers who now know their email credentials sat in a system that got breached for months before the full scale came to light.