Up to 14.2 million email addresses and passwords may have been exposed after attackers gained unauthorized access to an email system KDDI operates for itself and several Japanese ISPs, the carrier acknowledged on June 17.
KDDI-managed email platform: scope and detection
KDDI posted a notice (PDF) saying it detected unauthorized access to the email system it provides to third-party customers on June 17. The company said it investigated and prevented further intrusion on the same day it noticed the activity, and has since bolstered its defenses. KDDI also said it has informed the relevant authorities and is still completing its investigation, and therefore does not yet know the full extent of the incident.
The exploited third-party software
According to a machine translation of KDDI's posting, attackers exploited a vulnerability in third-party software used on the managed email service. The carrier's statement did not identify the specific software or say whether the vulnerability was a zero-day; it also did not explain why that vulnerable software was running on the platform. KDDI said it carried out an internal investigation that led to the conclusion the compromise leveraged that third-party component.
14.2 million credentials at potential risk
KDDI warned that up to 14.2 million email addresses and passwords may have leaked as a result of the intrusion. The company said the passwords had been hashed and encrypted, and framed that detail as limiting immediate technical impact: the presence of hashed and encrypted password data means the likely harms are phishing and identity theft, rather than "something nastier," according to the reporting. KDDI also noted some of the potentially exposed records belong to dormant or cancelled accounts, which could make notification and remediation of affected users difficult if attackers actually obtained the data.
Partner ISPs: STNet, JCOM, Chubu Telecommunications Co., Nifty Corporation, BIGLOBE
KDDI is not only a user of the compromised platform; it supplies the same managed email service to other Japanese ISPs. The companies named by the source as customers of KDDI's platform are STNet, JCOM, Chubu Telecommunications Co., Nifty Corporation, and BIGLOBE. Those providers now face the task of explaining KDDI's failure to their own customers and, as the Register observed, may reassess outsourcing arrangements with the carrier. The incident also invites questions from any other organisations that rely on KDDI for services about whether other KDDI platforms share the same risks.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: KDDI's account points to an exploited third-party component. Teams that operate outsourced or multi-tenant services will want to review dependency inventories and the processes that ensure third-party components are patched or removed, and to confirm the status and integrity of any hashing/encryption schemes in use.
- Affected enterprises and procurement leaders (including STNet, JCOM, Chubu Telecommunications, Nifty, BIGLOBE): partner organisations must notify customers where appropriate, reassess contractual responsibilities for incident response and data protection, and consider whether to revisit outsourcing choices in light of the breach and the ongoing investigation.
- End users and the general public: because KDDI says passwords were hashed and encrypted, the immediate practical risks reported are phishing and identity theft. Users should be alert for suspicious messages and account-credential reuse; companies will also have to wrestle with contacting customers when some exposed records belong to dormant or cancelled accounts.
KDDI’s public admission makes clear several immediate facts: detection occurred on June 17, the company believes a third‑party software vulnerability was exploited, it halted further intrusion the same day, it has told authorities, and it has not yet completed its investigation. What remains to be answered in the record KDDI provided is which third‑party component was involved, how attackers obtained access, and whether the feared leakage of up to 14.2 million account records can be confirmed and traced to known actors. Until KDDI completes its inquiry and releases more detail, customers, partner ISPs and security teams will be left to act on a mix of confirmed mitigations and unresolved questions.
Original report: You have got to be KDDI-ng – Japanese telco exposes 14.2 million managed email credentials
