Introduction
The Japanese telecommunications operator KDDI Corporation has announced a data breach affecting up to 14.2 million email logins at six ISPs. The breach was discovered on June 17, and KDDI immediately took action to block the attacker and implement defense measures. The investigation revealed that the hackers exploited a vulnerability in an unnamed third-party software used by KDDI Corporation. Although technical defensive measures have been implemented, there remains a possibility that email addresses and passwords were obtained by unauthorized third parties. KDDI warns that the exact number of impacted accounts has yet to be determined.
Technical Details
KDDI is one of Japan's largest ISPs, with 45,000 employees and an annual revenue of $32.4 billion. The breach impacted five ISP operators and their email services. The company has been contacting affected ISPs since June 17 and has notified the Personal Information Protection Commission and the Ministry of Internal Affairs and Communications.
Mitigation Strategies
KDDI has implemented additional security measures to mitigate the risks arising from this exposure. Affected customers are advised to reset their email account passwords and set up two-factor authentication (2FA) for additional protection.
Related Breaches
In the same month, Nikkei disclosed a third data breach, exposing 1.8 million records. Additionally, Burger King Japan exposed 11 million customer records, and Nippon Columbia exposed 8.6 million karaoke fan records.
Conclusion
KDDI's data breach highlights the importance of robust security measures and the potential risks of third-party software vulnerabilities. The company is working with affected ISPs to implement additional security measures to mitigate the risks.
Comments