14 Million Emails Gone: The KDDI Breach

Japan's second-largest telecommunications company, KDDI, confirmed on June 23 that a cyberattack on its email infrastructure may have exposed up to 14.22 million email addresses and passwords [1]. The breach affects six internet service providers that rely on KDDI's backend email platform, including JCOM, Nifty, and BIGLOBE, all of which serve millions of Japanese households [2].

This is not a small regional incident. KDDI is a major national carrier. The affected ISPs collectively cover a significant slice of Japan's consumer internet market, and the leaked data includes credentials for active accounts, dormant accounts, and even users who had already cancelled their service.

What happened

KDDI detected unauthorized access to its ISP email system on June 17, 2026. The company says the attackers exploited a vulnerability in third-party software used within the email platform. KDDI patched the affected infrastructure on the same day and reported the incident to Japan's Personal Information Protection Commission and the Ministry of Internal Affairs and Communications [3].

The potentially leaked data includes email addresses and passwords for up to 14.22 million mailboxes. KDDI notes that the compromised passwords were "hashed or encrypted," but the company has not clarified what percentage of credentials were actually protected, which hashing algorithms were used, or whether any plaintext passwords were in the dump [2].

The password question nobody can answer

When a breach disclosure says leaked passwords "include hashed or encrypted" credentials, that sentence is doing a lot of quiet work. It tells you that some passwords were hashed. It does not tell you that all of them were. The distinction matters enormously.

A bcrypt hash with a proper cost factor is effectively uncrackable for most attackers in 2026. An MD5 hash is essentially plaintext. A legacy system storing passwords with reversible encryption is worse than plaintext if the attacker also grabbed the key. KDDI has not said which algorithms were in use, what proportion of the 14.22 million records were protected, or whether any credentials were stored in a format that can be recovered.

Without that information, affected users should assume the worst and change passwords everywhere they might have been reused.

Credential stuffing is the real threat

The immediate danger is not that someone reads your email. It is that attackers take leaked email and password pairs and run them against banking portals, e-commerce sites, government services, and social media accounts. Japan has dealt with credential stuffing campaigns before, some involving tens of millions of authentication attempts [2].

A database of 14.22 million credentials, even a partial one, goes straight into those workflows. Attackers do not need to crack hashes if some passwords were stored in plaintext or weakly protected. They just need one working combination per target account.

The disclosure gap

KDDI's statement covers the regulatory basics: they detected the breach, they patched it, they filed the required reports. What it does not cover is the technical detail that would help people understand the actual risk [3].

Which third-party software was exploited? How long did the attackers have access before June 17? Were the passwords stored using modern algorithms or legacy ones? Has KDDI found evidence that the data was actually exfiltrated, or only that it was accessible? None of these questions have public answers yet.

KDDI also has a prior incident on its record. In 2022, the company's au mobile platform was hit by a SIM swap fraud campaign affecting roughly 3.5 million accounts, which drew public criticism over response time and communication quality [2]. This breach is larger by raw numbers and arguably broader in risk, since email credentials are reused across unrelated services far more often than mobile account credentials.

What to do if you are affected

If you use email through any of the six affected ISPs, STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, or BIGLOBE, change your email password today. Do not wait for your ISP to send a notification. The decentralized notification process means delivery speed and clarity will vary by provider [1].

More importantly, change your password on any other service where you reused the same credentials. Email passwords are among the most commonly reused passwords across the internet, and credential stuffing attacks can begin within hours of a breach becoming public.

And if you are running email infrastructure for anyone else, whether that is a company, a community, or a household, take a hard look at your password storage. If you cannot confidently say "bcrypt with cost 12 or higher" when asked how passwords are hashed, that is the vulnerability that leads to tomorrow's headline [2].