ISP Breach Exposes 14M Japanese User Credentials

Over 14 million current and former customers of six Japanese internet service providers (ISPs) may have had their email addresses and passwords exposed following a cyberattack. The breach was discovered on June 17, 2026, when KDDI Corporation detected unauthorized access to its database. Hackers leveraged a vulnerability in a third-party software used by the ISPs to gain access to the sensitive information.

While KDDI has implemented technical defensive measures and blocked the intruders, the possibility of credential theft remains. The incident affected not only KDDI but also five other ISPs: STNet, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE. A formal investigation is ongoing to determine the full extent of the breach.

Some passwords may have been stored in an encrypted format, rendering them inaccessible to attackers. However, the full number of such accounts is not yet known. In response, KDDI and the affected ISPs are collaborating to secure systems and mitigate the abuse of compromised credentials. Customers are strongly urged to change their account passwords and enable two-factor authentication to protect themselves from potential account takeovers.