KDDI Confirms Data Breach Affecting Over 12 Million Users 

Leave a Comment / Cybersecurity, Data Protection, Enterprise Technology, Industry News / By cxojunction

Japanese telecommunications provider KDDI has confirmed a major cybersecurity incident that exposed the email addresses and credentials of millions of users. The compromise involved a shared email platform used by five internet service providers (ISPs), prompting immediate containment measures and a detailed investigation.

The findings revealed that threat actors gained unauthorized access on May 16 by exploiting a previously unknown zero-day vulnerability in third-party software. At the time of the incident, the software vendor was unaware of the flaw and has since reported it to the relevant authorities. The affected providers include STNet, JCOM, Chubu Telecommunications, NIFTY Corporation, and BIGLOBE.

The company said the incident may have impacted up to 14.22 million current, former, and inactive accounts. More than 12.23 million email addresses and over 7.61 million passwords were accessed. While some credentials were protected using hashing or encryption, it has not disclosed how many were stored in plaintext or the encryption methods used.

To reduce the risk of account misuse, password resets are being enforced in coordination with partner ISPs, particularly for users who rarely access their email services. Additional security measures include the deployment of Endpoint Detection and Response (EDR) technology, a completed forensic review confirming the vulnerability has been remediated, and notification of Japan’s relevant regulatory authorities.

The incident highlights the growing risks associated with zero-day vulnerabilities and third-party software dependencies. It reinforces the importance of rapid incident response, stronger supply chain security, and continuous monitoring to better safeguard critical digital infrastructure and customer data.

CXO Junction remains dedicated to providing you with exclusive insights into transformative leadership journeys. Stay tuned for more updates as we continue to bring industry news to you.

Source: Telco giant KDDI says data breach affects over 12 million people | BLEEPING COMPUTERS | https://www.bleepingcomputer.com/news/security/japanese-telecom-giant-kddi-says-data-breach-affects-12-million-people/