InfoSecBulletin Cybersecurity for mankind
KDDI Corporation, a Japanese telecom company, revealed a data breach. Hackers got into one of its email systems that five other internet providers use. The company found the incident on June 17 and quickly blocked the attacker and set up defense measures.
The investigation found that hackers took advantage of a weakness in a third-party software that KDDI Corporation used.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
“Although technical defensive measures have already been implemented for the system, there remains a possibility that customers’ email addresses and passwords were obtained by unauthorized third parties as a result of the incident,” KDDI warns.
Scale of exposure
KDDI is one of the biggest internet providers in Japan. It has 45,000 workers and makes about $32.4 billion each year. Since 2000, it has been a public company after IDO, DDI, and KDD merged. KDD was Japan’s old state-run international telecom provider.
The company says that the incident affected five internet service providers and their email systems:
STNet, Inc.
JCOM Co., Ltd.
Chubu Telecommunications C., Inc.
NIFTY Corporation
BIGLOBE Inc.
Although they are still looking into the incident and do not know how many accounts were affected, KDDI said it might have revealed the email addresses and passwords of about 14.22 million customers.
Another helpful point, as KDDI says, is that some passwords were kept in a hashed or encrypted way. This means they can’t easily be misused for account takeovers, even if they are leaked.
KDDI did not say what kind of encryption was used or how many accounts had passwords kept in plain text. KDDI says it has been reaching out to affected ISPs since June 17. It has also informed Japan’s Personal Information Protection Commission and the Ministry of Internal Affairs and Communications.
The company is working with ISPs to add more security steps to reduce the risks from this issue. Customers who might have been affected should change their email account passwords quickly. If two-factor authentication (2FA) is an option, it’s a good idea to set it up for more security.
