KDDI email-platform breach exposes up to 14.2 million ISP logins

On 24 June 2026, Japanese telecommunications giant KDDI Corporation disclosed a data breach affecting a shared email platform it operates on behalf of several internet service providers, warning that up to 14.22 million email addresses and passwords may have been exposed. The company said it had detected the unauthorised access on 17 June 2026 and moved to secure the affected system.

The breach is notable for its blast radius across shared infrastructure: because KDDI runs the same email back end for multiple ISPs, a single intrusion put credentials from six different providers at risk simultaneously.

What happened

KDDI's investigation found that the attacker exploited a vulnerability in third-party software integrated into the email system, gaining unauthorised access to information associated with user mailboxes. The data potentially exposed includes the email addresses and passwords needed to operate accounts created across the affected services.

The maximum exposure figure of 14.22 million records is an upper bound that includes inactive accounts and users who had previously closed their services, so the number of currently active customers affected is likely lower.

Affected providers

The email services run through KDDI's platform span six internet service providers, including:

• STNet
• KDDI Web Communications
• J:COM
• Chubu Telecommunications
• Nifty
• Biglobe

Response

KDDI said it immediately modified the affected system and deployed protective measures after identifying the entry point the attacker had used. The company urged potentially affected users to remain alert for follow-on phishing and to change their passwords.

Why it matters

The incident underlines the concentration risk of shared back-end infrastructure in the telecom and ISP sector: consolidating email hosting across many consumer-facing brands is efficient, but it means a single exploited dependency can cascade into one of the largest credential exposures of the year. Exposed email/password pairs are especially damaging because they fuel credential-stuffing attacks against unrelated services where customers reuse the same passwords.