Japanese telecommunications giant KDDI says 12 million emails were exposed in major cyberattack

KDDI confirms unauthorized access affecting six ISPs, with up to 14.22 million email addresses and passwords exposed
Some passwords were not encrypted; with estimates citing 12.2 million emails and 7.6 million passwords compromised
The company urged quick updating of passwords, coordinating countermeasures with ISPs, and promised to prevent recurrence.

KDDI, one of Japan’s largest telecommunications providers, confirmed that it was recently hacked and lost millions of unencrypted emails and passwords belonging to its customers’ customers.

In a data breach notice, shared last month, the company said it confirmed an “unauthorized access” on June 17, 2026.

“As a result, some information from the email services offered by these ISPs may have been leaked externally,” reads the machine translation of the notice.

Coordinate countermeasures

The incident allegedly affected an email system that KDDI uses to manage customer email accounts, webmail, and email storage.

KDDI says the attack affected six ISPs: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty Corp and BIGLOBE. Up to 14.22 million email addresses and passwords linked to these mailboxes were allegedly exposed, including both former customer accounts and inactive users.

“Some” passwords were hashed or hashed, the company further said, suggesting some were not. He also stated that the 14.22 million figure represents a “maximum estimate” and that the investigation is still ongoing. The Record reported that 12.2 million customer email addresses and 7.6 million passwords were exposed.

Since detecting the intrusion on June 17, KDDI has contacted ISPs to “coordinate countermeasures” and urged its customers to update their passwords as soon as possible. “Customers should immediately follow the instructions provided by their ISP,” it said. “KDDI will continue to work with ISPs to notify customers and support rapid password updates.” He also said that “many customers” have already updated their passwords.

“We are analyzing the scope of the impact and the cause, responding to customers in coordination with ISP operators and taking measures to prevent a recurrence,” the company said.

KDDI is one of the largest telecommunications companies in Japan and rivals NTT Docomo and SoftBank. It serves approximately 72 million mobile subscribers.

Through The record