Loading story…
KDDI disclosed that a cyberattack against an email platform it operates for five Japanese internet service providers exposed more than 12.2 million customer email addresses and 7.6 million passwords. The compromised system supported customer account management, webmail, and email storage, and the company said the intrusion was enabled by a vulnerability in third-party software used by the platform. KDDI initially reported the unauthorized access in June and later confirmed the scale of the breach after a forensic investigation and notification to Japan’s communications ministry.
The company said it patched the flaw and modified the affected system immediately after detecting the attack, adding that investigators found no evidence of compromise beyond exploitation of the vulnerable software. KDDI also said its own consumer email services for mobile and fixed-line internet customers run on separate infrastructure and were not affected. The incident has prompted affected ISPs to coordinate mandatory password resets for impacted users and underscored the risk that a single flaw in shared third-party software can cascade across multiple providers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After completing a forensic investigation and reporting to Japan's communications ministry, KDDI said the cyberattack exposed more than 12.2 million customer email addresses and 7.6 million passwords across five Japanese ISPs. The affected providers began coordinating mandatory password resets for impacted users.
After detecting the intrusion, KDDI said it immediately patched the exploited vulnerability and modified the affected system. Investigators found no evidence of compromise beyond exploitation of that flaw.
KDDI confirmed the incident on 2026-06-17, disclosing unauthorized access to an email platform it operates for multiple Japanese internet service providers. The company said the intrusion was enabled by a vulnerability in third-party software used by the platform.
KDDI said attackers initially breached the email platform on 2026-05-16 by exploiting a zero-day vulnerability in third-party software used by the service. The platform supported five Japanese ISPs affected by the later breach disclosure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcesecuritymagazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
KDDI disclosed unauthorized access to an email platform it operates for itself and multiple Japanese internet service providers, warning that up to **14.22 million** email account records may have been exposed. The affected service supports KDDI and providers including **STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and BIGLOBE**. KDDI said the intrusion was detected on June 17 and linked to exploitation of a vulnerability in third-party software used by the system, after which it blocked further access and added defensive measures. The potentially exposed data includes email addresses, passwords, and some personal information tied to active, dormant, and canceled accounts. KDDI said the password data was hashed or encrypted, but it has not publicly clarified the protection status or algorithms for all records, and the full scope of the incident remains under investigation. The company reported the breach to Japan’s **Personal Information Protection Commission** and the **Ministry of Internal Affairs and Communications**, and is coordinating customer notifications and password resets with the affected ISPs.
Jun 30, 2026
Crunchyroll disclosed that a breach at a third-party service provider exposed the email addresses of roughly **6.8 million to 7 million subscribers**. Reports said the incident affected subscriber contact data rather than payment information or passwords, with the anime streaming company indicating the compromise occurred outside its own core environment. The exposure raised phishing and account-targeting risks for a large portion of Crunchyroll’s user base, as attackers could use the leaked addresses to impersonate the company or deliver credential-harvesting messages. Coverage of the incident described it as a major supply-chain style data exposure tied to a vendor, underscoring how breaches at external partners can affect millions of customers even when a company’s internal systems are not directly penetrated.
Jul 10, 2026
Aflac Life Insurance Japan disclosed that an unauthorized third party accessed its systems between June 15 and June 25, exposing data tied to about **4.38 million customers**. The company said the compromised information included names, dates of birth, addresses, phone numbers, policy coverage details, and data related to insurance representatives and commercial agencies; roughly **230,000 records** also contained bank account information. Aflac said the incident was limited to its Japan operations, that U.S. business systems were not accessed, and that affected systems were suspended after the intrusion was discovered on June 25. The breach adds to a broader pattern of cyber incidents affecting Japanese organizations, where public reporting has shown hundreds of ransomware and extortion-related cases and frequent abuse of internet-facing systems such as VPN appliances and RDP. Research on disclosed incidents involving Japanese firms found that attackers often move quickly to leak or weaponize stolen data and increasingly time disruptive actions for nights or weekends, underscoring the operational pressure facing defenders. Aflac said it has brought in third-party cybersecurity experts and notified Japan’s Financial Services Agency and police, while stating that no confirmed misuse of the stolen data had been identified at the time of disclosure.
Jul 7, 2026