Attackers used a flaw in unnamed third-party software to reach a shared email platform run for KDDI and five other Japanese ISPs. Email addresses and passwords are both in scope.
Japanese telecoms operator KDDI has disclosed that attackers broke into a shared email platform it runs for itself and five other Japanese internet service providers, potentially exposing up to 14.22 million email addresses and passwords. KDDI spotted the intrusion on 17 June 2026, blocked the attacker the same day, and made the breach public on 23 June, citing a vulnerability in unnamed third-party software used on the system.
The investigation is not finished, so the 14.22 million figure is a worst-case ceiling. It spans current customers, former customers, and dormant accounts that may no longer be in use. Crucially, account passwords sit alongside email addresses in the exposed data. That is the line between a routine address leak and a credential breach. Credentials open inboxes.
KDDI listed five affected ISP operators and their email services:
- STNet, Inc.
- J:COM (JCOM Co., Ltd.)
- Chubu Telecommunications Co., Inc.
- NIFTY Corporation
- BIGLOBE Inc.
The spread is the story. One platform, one third-party flaw, and the reach extends across five separate customer bases at once. Shared and managed mailbox infrastructure is common across the ISP world. So is the risk that a single weak component carries a breach far beyond the operator that installed it.
KDDI did offer one mitigating detail. It says a portion of the passwords were held in hashed or encrypted form, which would keep those out of immediate reach even if they leaked. The weakness is in what the company left unsaid. KDDI has not stated how many passwords were stored in plaintext, nor what hashing or encryption was applied. Without those figures, “some were protected” cannot be turned into a usable risk assessment. In 2026, any email password sitting in plaintext or behind a weak hash is the part that counts.
A second gap matters as much. KDDI has not named the third-party software or its vendor, and no CVE has been published. That leaves every other operator guessing. Anyone running the same component has no named product to check their own exposure against. For a flaw that demonstrably scales across tenants, naming the software is what lets the wider industry respond.
On process, KDDI moved at a reasonable pace. It notified Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications, and says it has been in contact with the affected ISPs since 17 June. Public disclosure landed six days after detection. The company says it is now working with the ISPs on further mitigation.
For the email industry, the downstream risk is well worn. Exposed ISP credentials feed credential stuffing wherever subscribers reused a password, and hijacked consumer mailboxes become launch points for spam and phishing. That is an inbound abuse problem for every mailbox provider and a reputation problem for any sender whose mail shares space with compromised accounts.
KDDI is telling affected customers to reset their email passwords now and switch on two-factor authentication where it exists. The unique-password part does most of the work, given how much account-takeover risk rides on reuse. Two-factor support is still patchy across consumer ISP webmail, so it will not be on the table for everyone.
The investigation continues. KDDI has yet to publish indicators of compromise, attribute the attack, or name the vulnerable software. Until it does, anyone holding a mailbox at the named providers should treat their credentials as already in circulation.