KDDI Says ISP Email Platform Breached, Up to 14.22 Million at Risk

2026-06-23

KDDI said on the 23rd that its email system provided to internet service providers had been subject to unauthorized access, potentially exposing up to 14.22 million items of personal information. The data may include email addresses and passwords, and email content may also have leaked.

Overview of the damage

Affected are six external ISPs

KDDI said the systems it provides to six external internet service providers were affected. The companies are STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty and Biglobe. KDDI's own email service runs on a separate platform and was not affected.

Exploiting a vulnerability

Case discovered on the 17th, fixes implemented

The company said it became aware of the situation on the 17th and implemented system changes to prevent the damage from spreading. A vulnerability in third-party software was exploited, it said. It also identified points suspected of unauthorized access and put technical safeguards in place.

Email addresses and passwords confirmed

Possible login-enabled state

At present, the company has confirmed the leakage of email addresses and passwords linked to mailboxes created on the affected email service. The mailboxes are believed to have been in a state that allowed logins, raising the risk of unauthorized viewing of emails and misuse of sending functions.

Users urged to update passwords

Reported to the Personal Information Protection Commission and the internal affairs ministry

Through the ISPs, KDDI is urging affected users to update their passwords immediately. It has also reported the case to the Personal Information Protection Commission and the Ministry of Internal Affairs and Communications, and will work with the ISPs to quickly identify the scope of the impact.

Breaches piling up in telecom sector

Listed firms reported 180 incidents

According to Tokyo Shoko Research, the number of personal information leak and loss incidents disclosed by listed companies and their subsidiaries in 2025 rose to 180. The number of victims more than doubled from a year earlier to over 30 million, and 60% of the causes were unauthorized access or virus infections.

At KDDI, an accounting irregularity involving fictitious transactions at a subsidiary engaged in online advertising brokerage was discovered in January, leading to the resignation of the subsidiary's president. President Hiroki Matsuda also returned part of his monthly remuneration. In an extraordinary report released on the 23rd, approval for the appointment of Chairman Makoto Takahashi was 62.34% in a directors' confidence proposal put to the annual shareholders' meeting on the 17th, while Matsuda received 77.67%, both sharply below the more than 90% seen a year earlier.

Enjoyed this article? Share it with your network!