Loading story…
KDDI disclosed unauthorized access to an email platform it operates for itself and multiple Japanese internet service providers, warning that up to 14.22 million email account records may have been exposed. The affected service supports KDDI and providers including STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and BIGLOBE. KDDI said the intrusion was detected on June 17 and linked to exploitation of a vulnerability in third-party software used by the system, after which it blocked further access and added defensive measures.
The potentially exposed data includes email addresses, passwords, and some personal information tied to active, dormant, and canceled accounts. KDDI said the password data was hashed or encrypted, but it has not publicly clarified the protection status or algorithms for all records, and the full scope of the incident remains under investigation. The company reported the breach to Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications, and is coordinating customer notifications and password resets with the affected ISPs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
KDDI reported the incident to Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications. It also began coordinating with affected ISPs on customer notifications and password resets.
KDDI disclosed that unauthorized access may have exposed up to 14.22 million email account records, including email addresses and passwords tied to active, dormant, and canceled accounts across six ISPs. The company said the password data included hashed or encrypted passwords, while the full scope of the incident remained under investigation.
On the same day it detected the attack, KDDI said it blocked further intrusion, implemented containment measures, and strengthened defenses around the affected service.
KDDI detected an intrusion into an email platform it operates for itself and multiple Japanese ISPs. The company attributed the access to exploitation of a vulnerability in third-party software used by the system.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcescworld.com
Open sourceteiss.co.uk
Open sourcecysecurity.news
Open sourcesecurityaffairs.com
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourcethecybersecguru.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Crunchyroll disclosed that a breach at a third-party service provider exposed the email addresses of roughly **6.8 million to 7 million subscribers**. Reports said the incident affected subscriber contact data rather than payment information or passwords, with the anime streaming company indicating the compromise occurred outside its own core environment. The exposure raised phishing and account-targeting risks for a large portion of Crunchyroll’s user base, as attackers could use the leaked addresses to impersonate the company or deliver credential-harvesting messages. Coverage of the incident described it as a major supply-chain style data exposure tied to a vendor, underscoring how breaches at external partners can affect millions of customers even when a company’s internal systems are not directly penetrated.
Jul 5, 2026
Dutch authorities reported a prolonged compromise at the Dutch prisons agency **DJI**, where attackers reportedly maintained access for at least **five months**. Exposed information included staff **email addresses, phone numbers, and security certificates**, and the Dutch NCSC indicated the intruders also accessed **phones, tablets, and laptops**, though the extent of data access on those endpoints was not confirmed; DJI did not confirm whether access had been fully removed. Separately, Dutch telecom **Odido** disclosed a **data breach followed by an extortion attempt**, after which attackers publicly released about **1M records** (including **317k unique email addresses**) and threatened additional leaks. The published data reportedly included **names, physical addresses, phone numbers, bank account numbers**, and customer-service notes; Odido’s notice also warned that **dates of birth** and government ID numbers (passport/driver’s license) were impacted. A **Canadian Tire** breach entry describes a different incident in Canada (October 2025) involving ~**42M records** with PBKDF2-hashed passwords and some partial payment-card metadata, and is not part of the Netherlands-focused events above.
Jun 29, 2026
**Tenga** disclosed a data breach after an attacker gained unauthorized access to a single employee’s professional email account, allowing visibility into the mailbox contents and enabling outbound spam/phishing to the employee’s contacts, including customers. The exposed information potentially included customer **names, email addresses, and historical email correspondence**, which may have contained **order details** or customer service inquiries; Tenga said a forensic review determined the incident affected **approximately 600 U.S. customers**. Tenga characterized the incident as localized and limited in scope, stating its broader systems and databases outside the U.S. were not impacted and that **no Social Security numbers, payment card data, billing information, or store passwords** were compromised. Post-incident actions described included resetting the affected employee’s credentials and implementing or expanding **multi-factor authentication** across systems; customers were advised to remain vigilant for suspicious emails and consider changing passwords as a precaution, particularly for messages appearing to come from the impacted employee account.
Jun 29, 2026