KDDI Data Breach Exposes 14.2 Million Managed Email Credentials

Japanese telco KDDI has disclosed unauthorized access to an email system it manages for itself and several other local ISPs, potentially exposing approximately 14.22 million users. Attackers reportedly exploited a vulnerability in an unnamed third-party software used on the email service.

The company warned that millions of email addresses and passwords may have been leaked in this data breach , which it detected on June 17, 2026. According to KDDI, the passwords were hashed and encrypted, limiting the immediate risk to phishing and identity theft rather than direct account compromise.

KDDI is one user of the breached platform and also provides it to Japanese ISPs:

Those providers now face questions from their own customers the exposure.

KDDI says it prevented further intrusion on the same day it detected the attack and says it has strengthened its defenses to block future incidents. The company announcement said the carrier has informed the relevant authorities of the situation but has not yet completed its investigation and remains unaware of the full extent of the incident.

Some of the data KDDI believes may have leaked pertains to dormant or cancelled accounts, complicating notification.

Earlier this year, a data breach at Dutch telecom provider Odido exposed almost 690,000 telecom customer accounts. In May, Lumen’s Black Lotus Labs identified a previously undocumented Linux malware family designated as Showboat that targets global telecommunications infrastructure.

In other recent news, Tata Electronics confirmed a data breach , and Texas Parks & Wildlife announced an intrusion that affects 3 million individuals.