Attackers exploited a third-party software vulnerability in KDDI’s shared email platform, potentially exposing login credentials of up to 14.22 million customers across six ISPs: STNet, JCOM, Chubu Telecom, NIFTY, BIGLOBE, and KDDI Web Communications. The breach was detected June 17. KDDI notified Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications.
The attack vector was not the ISPs themselves. It was the shared infrastructure layer that connected them. One vulnerability, one platform, six operators, 14.2 million accounts.
Under Japan’s APPI, KDDI faces a 60-day deadline for filing its final breach report with the PPC — putting the deadline in mid-August 2026.
What this means for your compliance team:
→ Shared infrastructure creates shared breach exposure. The ISPs affected did not independently suffer a security failure — they inherited one through a common platform dependency. Your breach risk assessment must include your suppliers’ suppliers.
→ Japan’s APPI breach notification framework requires both a preliminary report (within 3–5 days of discovery) and a final report (within 60 days). Organisations with Japanese operations or customers need dual-phase response playbooks.
→ Email credential breaches cascade. Compromised email logins become the entry point for credential stuffing, account takeover, and phishing across every service linked to those addresses.
→ The scale — 14.2 million accounts across six operators — demonstrates why regulators are increasingly focused on critical infrastructure concentration risk.
At S8fe.ai, we help organisations map their data inside their infrastructure and beyond. We give organisations the tools to map prioritize remediation actions across all the relevant data architecture — before the vulnerability is someone else’s to discover.
One platform. One vulnerability. Six operators learned about their breach from someone else’s incident report.
Source: https://securityaffairs.com/194387/data-breach/kddi-data-breach-impacts-up-to-14-2-million-email-accounts-at-six-isps.html