KDDI Multi-ISP Email Credential Exposure in Japan

Attackers gained unauthorized access to **KDDI's email system** used by several Japanese ISPs and exposed customer credentials across multiple providers in Japan. KDDI said the compromise affected services tied to **STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty Corporation, and Biglobe**, with **up to 14.22 million** email addresses and passwords likely compromised. The intrusion was detected on **June 17** and publicly confirmed on **June 23**. Available evidence indicates the actor exploited a vulnerability in **third-party software** used in the email system, but the software name, vulnerability identifier, and intrusion actor have not been disclosed. The exposed data creates immediate risk of mailbox compromise, password reuse abuse, and follow-on account access against affected users. Available evidence does not confirm broader downstream abuse, and no public CVE is attached to the intrusion. KDDI said it modified the system to prevent further damage, implemented technical countermeasures at suspected compromised locations, and notified Japan's **Personal Information Protection Commission** and the **Ministry of Internal Affairs and Communications**. Affected customers were strongly advised to **change passwords**, and response activity is centered on containment, user action, and coordination with the impacted ISPs.