KDDI Breach Exposes 14 Million Email Logins at Six ISPs

Email credentials are not abstract data. They are the keys to your identity online — password resets, banking alerts, tax documents, private conversations. When KDDI disclosed on June 28, 2026 that attackers had accessed its email infrastructure eleven days earlier, the number attached to the breach was staggering: up to 14.22 million accounts across six of Japan's major internet service providers. Passwords were included. Some were hashed or encrypted; some may not have been. The investigation is still ongoing, and KDDI has not ruled out that plaintext credentials were obtained by whoever was on the other side of that connection.

Key Takeaways

• KDDI detected the breach on June 17, 2026, but did not publicly disclose it until June 28, 2026 — an eleven day gap during which affected users had no way to protect themselves.
• Up to 14.22 million email addresses and associated passwords were potentially exposed across six ISPs: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE.
• The attacker exploited a vulnerability in third party software integrated into KDDI's email platform; the vendor and software product have not been named publicly.
• KDDI reported the breach to Japan's Personal Information Protection Commission and the Ministry of Internal Affairs and Communications, and is working with all six ISPs on additional security measures.
• Affected users whose ISP email password matches passwords used on other services — including Gmail, banking portals, or corporate logins — face immediate credential stuffing risk.

What Happened at KDDI?

KDDI Corporation, one of Japan's three major mobile and broadband carriers, operates managed email infrastructure on behalf of multiple ISPs. On June 17, 2026, KDDI's security team identified unauthorized access to that infrastructure. According to BleepingComputer's reporting, the attacker exploited a vulnerability in third party software embedded in the email system. KDDI blocked the attacker and implemented defensive measures the same day it discovered the intrusion, but the damage window remains unknown — investigators have not confirmed how long the attacker had access before detection.

The six affected ISPs — STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE — serve a broad cross section of Japanese residential and business subscribers. KDDI has been coordinating with all six since June 17 and notified Japanese regulators. The company has urged customers to change their email passwords immediately, though as of the disclosure date it could not confirm exactly how many accounts were actually accessed versus merely exposed.

Were the Passwords Plaintext?

KDDI's statement says passwords were stored "in hashed or encrypted form," but the phrasing is deliberately cautious. "Hashed or encrypted" covers a wide spectrum — a well implemented bcrypt hash is practically uncrackable in any reasonable timeframe, while a simple MD5 hash can be reversed for the majority of common passwords within hours using commodity hardware and precomputed rainbow tables. KDDI has not disclosed which algorithm was used, nor whether all six ISPs used the same storage method. Until that detail surfaces, every affected user should treat their password as compromised.

The Infosecurity Magazine coverage notes that KDDI acknowledged a possibility that credentials "were obtained" by the threat actor — language that stops well short of a clean bill of health. That ambiguity is itself a signal: if KDDI were confident the hashes were computationally secure, the statement would say so.

Why Should This Concern Anyone Outside Japan?

ISP email accounts are high value targets precisely because people tend to forget about them. A subscriber who signed up for a BIGLOBE or NIFTY account a decade ago, rarely logs into the webmail interface, and uses the same password across multiple services is the ideal victim for credential stuffing — the automated technique where attackers feed stolen username and password pairs into login forms at scale until something works. The KDDI breach adds 14.22 million potential credential pairs to the ecosystem of stolen logins that circulates through dark web markets.

This follows a pattern that has become relentless in 2026. Earlier this year, 48 million Gmail logins surfaced in an infostealer database — credentials harvested not from Google's own systems but from devices whose users had been infected with malware. The KDDI breach is different in mechanism (a server side infrastructure attack rather than endpoint malware) but identical in consequence: more working email credentials available to attackers. And the aggregate effect compounds. Security researchers tracking the infostealer economy have documented dumps containing 24 billion credentials circulating in 2026 alone. Each new breach refreshes and expands that pool.

The supply chain angle also matters here. KDDI did not build the vulnerable software component — a third party vendor did. The vendor's identity remains undisclosed, which means other ISPs or email providers using the same software may be sitting on unpatched exposure right now. The Register's analysis raised exactly this question, noting that managed email infrastructure is frequently built on shared vendor stacks across the industry.

Why Email Users Should Care

Your email address is not just a communications channel — it is the recovery mechanism for almost every other account you own. An attacker with your email login can trigger password resets on your bank, your cloud storage, your social media profiles, and your work systems. This is why email credential breaches carry outsized risk compared to, say, a loyalty program database getting leaked. The KDDI breach puts email passwords specifically in play, not just names or phone numbers.

There is a subtler concern too. Many people use their ISP email as a secondary or recovery address linked to their primary Gmail account. If that ISP address and its password are now in attacker hands, an attacker can intercept recovery emails sent there, lock the legitimate owner out of Gmail, and pivot to every service connected to that Google account. The threat is not limited to the ISP inbox itself.

Russian state linked actors have already demonstrated that MFA on Gmail can be bypassed using app passwords generated through compromised recovery accounts. A stolen ISP credential that controls a recovery address is exactly the kind of foothold that makes that attack chain viable.

What Should Affected Users Do Right Now?

If you have or have ever had an email account through STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, NIFTY, or BIGLOBE, treat that account as fully compromised and take the following steps:

• Change the ISP email password immediately. Use a long, randomly generated password stored in a password manager. Do not reuse anything close to your old password.
• Audit every account that uses the ISP address as a recovery or login email. Change the recovery address on those accounts to a more secure alternative, or update those account passwords now in case an attacker already has them via credential stuffing.
• Enable two factor authentication on your primary email account and on every service that supports it. Even if an attacker has your password, 2FA blocks most automated attacks.
• Check whether the ISP email address appears in known breach databases using a service like Have I Been Pwned, which aggregates publicly disclosed breach data.
• Review your Gmail account's linked addresses and recovery options under Security settings. Remove any ISP email address you no longer actively control from the recovery chain.

Users who want broader control over their Gmail security posture — including how their inbox behaves with unknown senders and what data exposure looks like across their account — can find practical steps in our guide on stopping spam and reducing your Gmail attack surface in 2026.

The Eleven Day Disclosure Gap

KDDI detected the breach on June 17 and went public on June 28. Those eleven days matter. Credential stuffing attacks are highly automated — attackers do not wait for breach disclosure before testing stolen logins. By the time KDDI's press release reached users, any attacker who purchased or obtained the data could have already run millions of credential stuffing attempts across banking sites, e-commerce platforms, and email providers worldwide.

Japan's Personal Information Protection Commission has received KDDI's report and will determine whether the disclosure timeline met statutory obligations. Under Japan's Act on the Protection of Personal Information, organizations must report breaches to the commission promptly, but the law's definition of "promptly" has been interpreted with some flexibility. Whether eleven days qualifies as prompt notification when live email credentials are at stake is a question regulators will now have to answer.

What This Means Going Forward

The KDDI breach underscores a structural problem with managed email infrastructure: when a telecom or ISP outsources email platform components to third party vendors, the security posture of 14 million users depends not on the primary provider's own engineering team, but on a vendor who may not face the same scrutiny or accountability. KDDI absorbed the reputational damage; the unnamed software vendor has faced none.

Until the vendor is identified and the specific vulnerability patched across the industry, other ISPs running the same stack remain at risk. If you are a security professional managing email infrastructure for a carrier or regional ISP, this is a moment to audit your third party software dependencies — not after a breach is detected, but now.