- Japanese telecom titan KDDI Corporation confirmed a major data breach that potentially exposed the email addresses and passwords of millions of its users.
- Cybercriminals successfully infiltrated the central network, they exploited a security flaw in an external software product, which KDDI discovered and blocked on June 17.
- The security breach compromised five other prominent Japanese internet service providers that rely on KDDI’s email infrastructure, including STNet, JCOM, Chubu Telecommunications, NIFTY Corporation, and BIGLOBE.
Japanese telecommunications giant KDDI Corporation has officially confirmed a massive data breach within its core email system infrastructure. The company disclosed that unauthorized actors managed to break into their digital storage systems, and the hackers reportedly compromised up to 14.22 million customer accounts.
On June 17, network security teams first became aware of the abnormal computer operations and attempted to cut off access from the attacker. Although they were able to put emergency defense blocks in place that ultimately prevented any further data extraction, forensic analysis later indicated that the compromise originated from an unpatched security lapse present in a third-party application that was implemented across KDDI’s systems.
Since KDDI provides fundamental support to Japan’s digital infrastructure, many companies in the Asian technology sector are very concerned about the implications of this widespread security event.
Due to the fact that KDDI licenses its proprietary email architecture to several competitive regional networks, the security failure quickly cascaded beyond its own direct customer base.
The incident also impacted five other major Japanese internet service providers, STNet, JCOM, Chubu Telecommunications, NIFTY Corporation, and BIGLOBE, forcing all six companies to coordinate their incident response efforts to safeguard their users.
The Massive Scale of the Credential Exposure
This massive total did not just stop with current active users; it also contains legacy data belonging to historical customers who have since canceled their subscriptions. The sheer volume of data points involved reflects just how deeply embedded KDDI’s internet services are within everyday Japanese households and corporate offices.
Company officials indicated that they saved a segment of the exposed customers’ passwords using hashing or encryption techniques instead of plaintext. This security measure scrambled all of the characters, but theoretically, the character scrambling would make it much more challenging for normal cybercriminals to see, read, or access their credentials right away after stealing them.
The urgency of password resets in large-scale breaches is underscored by the recent ActMobile VPN data leak claim, where hackers alleged exposure of 45 million records containing user credentials.
However, KDDI did not share which type of encryption algorithms they employed for passwords, nor did they provide a specific percentage of the 14.2 million customers’ passwords they had created in entirely plaintext.
Following regulatory mandates, KDDI immediately reported the operational details to Japan’s primary data protection authorities and the national communications ministry, both of which are preparing to launch independent audits.
Urgent Defensive Actions for Affected Internet Users
In the wake of the system compromise, KDDI and its partner internet service providers have urged all potentially impacted customers to reset their login passwords immediately. Updating your credentials cuts off the hackers’ access, preventing them from using the stolen data to log into accounts remotely.
Security teams advise users to create entirely unique phrase combinations and strictly avoid recycling old passwords that they currently use on other shopping, banking, or social media platforms. In addition, many telecom admins are now instructing users to utilize two-factor authentication (2FA) as quickly as possible.
This added layer of security means that when a hacker is able to bypass the need for having the correct password, he would still need a time-sensitive verification code on their physical cellphone to gain access to the inbox.
Also, as hackers utilize compromised directories to send out massively targeted phishing emails and campaigns, all users must remain extremely cautious when receiving any type of unusual emails from any source. Often, hackers utilize the stolen data from hacked accounts to generate extremely realistic fake emails that intend to trick the victim into clicking on a malicious link or providing financial information.
