Data breach exposes up to 14.2 million email logins at six ISPs

KDDI Corporation, one of Japan's largest ISPs, disclosed a data breach affecting up to 14.2 million email accounts across six ISPs. Threat actors exploited a vulnerability in unnamed third-party software to access an email system shared by STNet, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE. Exposed data includes email addresses and passwords, though some passwords were stored in hashed or encrypted form. KDDI discovered the breach on June 17, notified Japanese regulators, and is advising affected customers to reset passwords and enable 2FA.