KDDI receives administrative guidance following massive email data breach

Japan's Ministry of Internal Affairs and Communications has issued administrative guidance to KDDI Corporation following a major data breach affecting approximately 7.62 million users. Between May 16 and June 17, unauthorized access to an email system provided to multiple internet service providers allowed third parties to view mailbox information, including email addresses and login passwords.

The Ministry criticized KDDI for failing to implement effective multi-layered defenses and noted that passwords were stored without adequate encryption or safety measures. Additionally, the Ministry stated that KDDI's response was not prompt, as it took 22 days to disclose the incident after being first notified by a provider. KDDI is required to report on its recurrence prevention measures and any secondary damage by August 31 and continue quarterly reporting for at least one year.