Japanese telecommunications giant KDDI this week confirmed that over 12 million people were affected by a June data breach.
The incident occurred on June 17 and involved unauthorized access to a system developed by KDDI as part of the email infrastructure used by five ISPs, namely STNet, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE.
KDDI’s mobile and fixed-line internet email services, which operate on separate infrastructure, were not affected by the attack.
A zero-day vulnerability in software implemented as part of the system was exploited during the attack, the telecoms giant explains.
An automated translation of KDDI’s notice (PDF) suggests that several ISPs have been affected by the bug’s exploitation since May, and that the vendor is now working on a patch for the zero-day.
The company also confirmed that the hackers compromised the email addresses of 12.2 million people, as well as the passwords of 7.6 million individuals.
KDDI says it has been working with the ISPs affected by the data breach to prompt password resets and that customers who use their email addresses on a regular basis have already updated their login information.
A mandatory password reset will be completed for all affected email accounts within the following days, the company says.
KDDI also noted that it evicted the hackers from its systems immediately after discovering the incident and that it has no evidence of additional suspicious activity.
The company says it will thoroughly inspect the involved software to ensure it does not contain other vulnerabilities and will work with the ISPs to transition to more secure communication technologies.
Related: Mount Royal University Confirms Data Stolen in Ransomware Attack
Related: Accenture Confirms Data Breach After Hacker Claims Source Code Theft
