Japanese telecommunications company KDDI has reported a significant data breach impacting an email platform used by five internet service providers (ISPs) in the country, potentially exposing the personal information of over 12 million individuals. The breach, discovered on June 17, led to unauthorized access to email addresses and passwords of current and former customers, as well as those associated with inactive accounts.
KDDI, Japan's second-largest mobile telecommunications provider, disclosed that the attackers gained access to the platform on May 16 by exploiting a zero-day vulnerability in a third-party software. At the time of the discovery, this vulnerability was not publicly known or recognized by the software vendor, according to KDDI. The software vendor has since reported the issue to authorities and is working on its disclosure.
The incident has resulted in the exposure of email addresses for 12,233,087 individuals and passwords for 7,616,173 individuals. KDDI stated that some passwords were stored in hashed or encrypted forms, which would make them more difficult for attackers to use for account hijacking. However, the company did not specify the number of accounts with plaintext passwords or the type of encryption used.
In response to the breach, KDDI has been working to secure affected email accounts by changing customer passwords. The company noted that many users, particularly those who regularly use email services, have already updated their passwords. For customers who do not frequently use email services, KDDI is coordinating with ISP providers to enforce mandatory password changes within one to two days.
KDDI has also implemented additional security measures, including the deployment of Endpoint Detection and Response (EDR) software to help detect future intrusion attempts. A forensic audit conducted on June 23 confirmed that the exploited vulnerability had been remediated and that no other security issues were found in the systems.
The company has officially notified Japan's Personal Information Protection Commission and the Ministry of Internal Affairs and Communications about the incident. KDDI is collaborating with the affected ISPs, STNet, JCOM, Chubu Telecommunications C, NIFTY Corporation, and BIGLOBE, to implement security measures aimed at mitigating the risks associated with the exposed data.
