KDDI Data Breach Exposes 14.22 Million Email Credentials in Japan Japanese telecommunications giant KDDI disclosed a major cybersecurity incident on June 17, 2026, after detecting unauthorized access to an email system used by multiple internet service providers (ISPs). The breach, linked to a third-party software vulnerability, may have exposed up to 14.22 million email addresses and passwords including inactive and closed accounts across six ISPs: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, and Biglobe. Affected services include Pikara Hikari, Pikara Mobile, J:COM NET, @nifty Mail, and BIGLOBE Mail, among others. While some passwords were stored in hashed or encrypted formats, KDDI warned the figure represents a worst-case scenario as investigations continue. The company has since strengthened security controls, notified affected ISPs, and urged users to reset their credentials. KDDI is cooperating with Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications in response to the incident. The breach underscores growing cybersecurity risks in Japan, where 180 personal data exposure cases were reported in 2025, affecting 30.6 million individuals. Ransomware attacks also surged, with 226 incidents recorded last year, targeting both small businesses and large enterprises like Asahi Group Holdings and Askul.