Japan Data Breach Exposes 14.22 Million Email Login Credentials

Post Views: 9

A major cybersecurity incident has been reported by KDDI Corporation, a leading Japanese telecommunications company, following unauthorized access to a system shared with five internet service providers (ISPs) in the country.

Overview of the Data Breach

Initial findings indicate that the breach may have compromised the email addresses and login credentials of up to 14.22 million customer accounts. The company identified suspicious activity on June 17 and promptly restricted the attackers’ access while implementing enhanced security protocols.

Details of the Breach

Further investigation revealed that threat actors exploited an undisclosed vulnerability in third-party software integrated into the organization’s infrastructure to gain entry. The affected ISPs include STNet Inc., JCOM Co. Ltd., Chubu Telecommunications Co. Inc., NIFTY Corporation, and BIGLOBE Inc.

Response from KDDI

KDDI confirmed that the impacted accounts encompass current, former, and inactive users. The company clarified that password storage practices varied across systems. Some credentials were protected through hashing and encryption, which reduces the risk of immediate exploitation, though the exact proportion of passwords stored in plaintext or the specific encryption methods used remain undisclosed.

Collaborative Efforts

KDDI initiated communication with the affected ISPs on June 17 and reported the incident to Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications. Collaborative efforts with the involved service providers are underway to strengthen defenses and mitigate potential risks.

Renowned cybercrime specialist and former IPS officer Prof. Triveni Singh noted that password reuse is a critical concern following large-scale breaches. Attackers could leverage compromised credentials to conduct credential stuffing attacks, targeting financial, social media, and other sensitive accounts.

Recommendations for Users

Prof. Singh recommended that users immediately update passwords for essential accounts and activate multi-factor authentication (MFA) where available. KDDI has advised affected customers to reset their passwords promptly and enable two-factor authentication (2FA) if the option is available.