KDDI Data Breach Affects More Than 12 Million People

Japanese telecommunications company KDDI has announced a major data breach that affected more than 12 million people.

According to the company, attackers breached an email platform used by five internet service providers (ISPs) operating in Japan. As a result of the attack, users' email addresses and passwords fell into the criminals' hands.

Scale of the incident

KDDI is one of Japan's largest telecommunications operators, so a data breach of this scale affects a significant portion of the subscribers who use the services of the providers associated with the company.

The company confirmed that the email platform had been compromised and acknowledged that the compromised data includes login credentials — the email addresses and passwords of users of the affected internet service providers.

Potential consequences

A credential leak of this scale creates risks for users: the compromised address-password pairs can be used by attackers for follow-on attacks, including attempts to log in to other services in cases where passwords have been reused, as well as for phishing campaigns.

KDDI has not yet disclosed the full set of technical details of the incident, including the exact attack vector against the email platform and the period during which the attackers had access to the data.

Users of the affected internet service providers are advised to change the passwords to their accounts and to be wary of suspicious emails that may use the stolen data for targeted attacks.

Source: Bleeping Computer