Data breach exposes up to 14.2M email logins at six ISPs

Japanese telecommunications operator KDDI Corporation disclosed a data breach affecting up to 14.2 million email logins across its system and five other ISPs after threat actors exploited a vulnerability in third-party software. The compromise, discovered on June 17, potentially exposed customer email addresses and passwords, though some passwords were stored in hashed or encrypted form, limiting their immediate usability. KDDI has notified affected ISPs and Japanese authorities, and is recommending customers reset passwords and enable two-factor authentication.