Japanese telecom KDDI disclosed a breach discovered June 17 in an email system shared by six ISPs.
KDDI says it discovered the compromise on June 17 and moved fast, blocking the attacker and rolling out defensive measures the same way most large carriers do after detection.
KDDI is not a small player.
KDDI offered one piece of cautious reassurance: some passwords were stored in hashed or encrypted form, which means they cannot be readily abused to hijack accounts even if exposed.
A leaked password from a random forum is annoying.
Read the complete breakdown, fixes and what happens next.