Japanese telecommunications company KDDI says 12 million emails have been exposed in major cyber attacks

KDDI confirms unauthorized access affecting six ISPs, with up to 14.22 million email addresses and passwords exposed
Some passwords were unencrypted; with estimates citing 12.2 million emails and 7.6 million compromised passwords
The company called for prompt password updates, coordinated countermeasures with ISPs, and promised repeat prevention

KDDI, one of Japan’s largest telecommunications providers, has confirmed that it was recently hacked and lost millions of emails and unencrypted passwords belonging to its customers’ customers.

In a data breach notification shared last month, the company said it confirmed “unauthorized access” on June 17, 2026.

“As a result, part of the information from email services offered by these ISPs may have been leaked externally,” reads a machine translation of the notice.

Coordination of countermeasures

The incident reportedly affected an email system KDDI uses to manage customer email accounts, webmail and email storage.

KDDI says the attack affected six ISPs: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty Corp and BIGLOBE. Up to 14.22 million email addresses and passwords associated with these mailboxes were reportedly exposed, which includes both former customers’ accounts as well as dormant users.

“Some” passwords were hashed or encrypted, the company further said, suggesting that some – were not. It also stated that the figure of 14.22 million represents a “maximum estimate” and that the investigation is still ongoing. The Record reported 12.2 million customer email addresses and 7.6 million passwords exposed.

Since discovering the intrusion on June 17, KDDI has contacted ISPs to “coordinate countermeasures” and urged its customers to update their passwords as soon as possible. “Customers should follow instructions from their ISP immediately,” it said. “KDDI will continue to work with ISPs to notify customers and support prompt password updates.” It also said that “many customers” have already updated their passwords.

“We are analyzing the extent of the impact and the cause, responding to customers in coordination with ISP operators and taking measures to prevent a recurrence,” the company said.

KDDI is one of Japan’s largest telecommunications companies, competing with NTT Docomo and SoftBank. It serves approximately 72 million mobile subscribers.

Via The record