Administrative Guidance to KDDI Over Communications Secrecy Breach

The Ministry of Internal Affairs and Communications addressed an unauthorized access incident involving an email system provided by KDDI as an internet service provider. The incident occurred from May 16, 2026, through June 17 of the same year, and unauthorized external access resulted in the leakage of information concerning users’ email addresses and passwords used to log in to the email system.

In this incident, information in the mailboxes of 762 users was in a viewable state. The Ministry of Internal Affairs and Communications determined that this constituted a breach of the secrecy of communications as stipulated in Article 4, Paragraph 1 of the Telecommunications Business Act.

The incident had a significant impact on users of telecommunications services and became a serious matter that substantially undermined user trust in the telecommunications business. The Ministry of Internal Affairs and Communications issued KDDI a stern warning to work to prevent recurrence and provided administrative guidance in writing.

To protect the secrecy of communications, the Ministry of Internal Affairs and Communications required KDDI to take necessary measures to prevent recurrence. In addition, it provided administrative guidance in writing, requesting a report on the implementation status of those measures.

The Ministry of Internal Affairs and Communications stated that it would work to provide the necessary guidance and supervision to protect the secrecy of communications.