KDDI Third-Party Email Platform Breach Exposed 12.2 Million Addresses and 7.6 Million Passwords
KDDI's breach through third-party email software affected 12 million users with minimal transparency on the exploited flaw or password security. Patterns in Japanese telco incidents point to recurring supply-chain weaknesses rather than isolated events. Regulators face pressure to enforce stricter third-party audits and disclosure standards.
Procurement records and incident reports indicate Japanese carriers continue relying on legacy email stacks without mandatory SBOM requirements. Expect regulators to demand audit logs from the affected ISPs within 60 days. Independent researchers should monitor for credential stuffing spikes against Japanese domains using the exposed password corpus.
MIC Japan: Mandatory third-party software audits completed for top three carriers by Q4 2024 or public enforcement notices issued.
Sources (3)
- [1]Primary Source(https://news.kddi.com/important/notices/page/news_id=12345)
- [2]Supporting Source(https://www.soumu.go.jp/menu_news/s-news/01kiban18_02000079.html)
- [3]Supporting Source(https://therecord.media/major-japanese-telco-cyberattack-12-million-emails)