The KDDI data breach highlights the serious risk created when email platforms used by telecom and internet service providers are compromised.

Attackers exploited a zero-day vulnerability in third-party software used by an email platform connected to several Japanese ISPs. The incident exposed more than 12 million email addresses and over 7 million passwords belonging to current, former, and inactive customers.

Some of the exposed passwords were reportedly stored in hashed or encrypted form, but the full protection level is unclear. Organizations should therefore treat affected credentials as compromised and force password resets rather than assume that encryption alone has removed the risk.

Email account compromise can have a broad impact. Attackers may use exposed credentials to access mailboxes, reset passwords for other services, impersonate users, conduct phishing, or search messages for financial, business, or personal information.

Customers should change affected email passwords immediately and avoid reusing those passwords on any other service. Where the same password was used elsewhere, those accounts should also be updated.

Service providers should enforce mandatory password resets, monitor suspicious login attempts, deploy multifactor authentication where possible, and review systems for additional weaknesses after a zero-day compromise.

The key lesson is that email remains one of the most valuable accounts attackers can steal. Once criminals control a mailbox, they often control the recovery path to many other services. Apparently, the humble inbox is still the master key nobody remembers they gave to everything.

Japanese telecommunications giant KDDI says that millions of people had their email addresses and passwords exposed after attackers breached an email platform used by five internet service providers (ISPs) in the country. [...]

Source: Telco giant KDDI says data breach affects over 12 million people via Bleeping Computer — published 08 Jul 2026.