KDDI Says Cyberattack Exposed 12.2 Million Email Addresses and 7.6 Million Passwords
Summary
KDDI says attackers exploited a third-party software vulnerability in an email platform serving five Japanese ISPs, exposing 12.2 million customer email addresses and 7.6 million passwords. It patched the flaw and said separate consumer services were unaffected.
Key points
- KDDI confirmed that the incident exposed 12.2 million customer email addresses and 7.6 million passwords.
- The affected platform managed email accounts, webmail, and storage for customers of five Japanese ISPs.
- KDDI attributed the intrusion to exploitation of a vulnerability in third-party software used by the platform.
- KDDI patched the flaw and modified the system; its investigation found no evidence of compromise beyond the affected vulnerability.
- KDDI said its separate consumer email services were not affected.
- Affected ISPs were working to complete mandatory password resets; many regular users had already changed their passwords.
Article Details
- Victim Organization
- KDDI
- Incident Type
- Cyberattack and data breach involving unauthorized access to an email platform through exploitation of a third-party software vulnerability.
- Data Types Exposed
- Customer email addresses
- Passwords
- Affected Records
- 12.2 million customer email addresses and 7.6 million passwords
- Operational Impact
- The email platform used by five Japanese internet service providers was affected. KDDI patched the vulnerability and modified the system; it reported no evidence that attackers compromised other systems. Affected providers were working to complete mandatory password resets. KDDI's separate consumer email services were not affected.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
Countries
Industries
Internet service providersKDDI said a cyberattack against an email platform it operates for five Japanese internet service providers exposed 12.2 million customer email addresses and 7.6 million passwords.TelecommunicationsOne of Japan’s largest telecommunications providers said Monday that a cyberattack targeting an email platform it operates for internet service providers exposed more than 12.2 million customer email addresses and 7.6