12 Million Impacted by Data Breach at Japanese Telco KDDI
KDDI reports 12 million impacted by data breach due to zero-day vulnerability.
Japanese telecommunications company KDDI has confirmed a data breach affecting over 12 million individuals. The incident, which occurred on June 17, exploited a zero-day vulnerability in a third-party system used for ISP email infrastructure. Hackers gained access to email addresses of 12.2 million people and passwords of 7.6 million individuals.
AI summary of the linked source. Not reviewed by an editor. How this works
Run KDDI?
Get an email when a new story names KDDI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe KDDI breach highlights the systemic risk of relying on third-party vendors for critical infrastructure without adequate oversight of their security posture. A zero-day vulnerability in a third-party ISP email system gave attackers access to email addresses and plaintext or weakly protected passwords for millions of customers, suggesting insufficient credential protection practices. This matters because organizations inherit the vulnerabilities of every vendor in their supply chain, yet often have limited visibility into those risks. The scale of exposure — 12.2 million email addresses and 7.6 million passwords — demonstrates how a single unpatched third-party component can cascade into a catastrophic data breach.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Automated patch management
Known holes get closed in days, not months.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.