News

• KDDI confirms unauthorized access affecting six ISPs, with up to 14.22 million email addresses and passwords exposed
• Some passwords were unencrypted; with estimates citing 12.2 million emails and 7.6 million passwords compromised
• Company urged rapid password updates, coordinated countermeasures with ISPs, and pledged recurrence prevention

KDDI, one of Japan’s largest telecommunications providers, has confirmed it was recently hacked and lost millions of emails and unencrypted passwords belonging to its clients’ customers.

In a data breach notice, shared last month, the company said that it confirmed “unauthorized access” on June 17 2026.

“As a result, part of the information from email services offered by these ISPs may have leaked externally,” a machine translation of the notice reads.

The incident allegedly affected an email system KDDI uses to manage customer email accounts, webmail, and email storage.

KDDI says that the attack affected six ISPs: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty Corp, and BIGLOBE. Up to 14.22 million email addresses and passwords linked to these mailboxes were allegedly exposed, which includes both accounts of former customers, as well as dormant users.

“Some” passwords were hashed or encrypted, the company further said, suggesting that some - were not. It also stated that the 14.22 million number represents a “maximum estimate”, and that the investigation is still ongoing. The Record reported 12.2 million customer email addresses and 7.6 million passwords exposed.

Since spotting the intrusion on June 17, KDDI has been contacting ISPs to “coordinate countermeasures” and urged their customers to update their passwords as soon as possible. “Customers should follow instructions provided by their ISP promptly,” it said. “KDDI will continue working with ISPs to notify customers and support rapid password updates.” It also said that “many customers” have already updated their passwords.

"We are analyzing the scope of the impact and the cause, responding to customers in coordination with ISP operators, and taking measures to prevent a recurrence," the company said.

KDDI is one of Japan's largest telecommunications companies, rivaling NTT Docomo and SoftBank. It serves approximately 72 million mobile subscribers.

Via The Record

Do you remember the metaverse? If you don’t, don’t worry. In 2026, four years into the AI revolution that’s changing the world forever, you could easily be forgiven for thinking it was a strange fever dream you had back in 2021. You might even have odd memories of seeing a blocky version of Mark Zuckerberg floating about in a Minecraft-inspired hellscape, conducting meetings with people who could walk with no legs, while the real Mark Zuckerberg was looking at the whole thing through VR goggles. At least, that’s my memory of it.

I could be suffering from the Mandela effect, but I distinctly remember something off about the legs. They fixed that in a later version, but that’s my overriding memory — no legs. Oh, and Mark Zuckerberg assuring us that this was the future. He’d spent tens of billions of dollars on it, even changing the company name from Facebook to Meta, just to let us know he was really serious about the metaverse. Even if the legs didn’t work.

The problem was, it looked laughable. While everything in the technology world to do with games and special effects was moving in the direction of hyper-realism, the metaverse was moving in the opposite direction, towards the sort of blocky graphics that small children enjoy. But even that didn’t really answer the most basic question about the metaverse. Why? What possible advantage was there for us all to meet in a VR space where clunky avatars of ourselves could interact… badly?

Then AI happened and Meta abruptly forgot about the metaverse and pivoted towards the mission of putting personal superintelligence in all our hands instead, which sounds as terrifying and dangerous as it actually is, but we are where we are. At least when Zuckerberg was obsessed with the metaverse, we could ignore him. It existed somewhere “over there”, in Meta-land, where we could let him get on with it. Now he’s right up in our business again.

I’ve always been fascinated by how Zuckerberg got into the metaverse and why he became so obsessed with it. The origins of the metaverse go way back. In March 2014, Facebook bought Oculus, the VR company, for about $2 billion. This was where his passion for VR started. Think of it as the seed, not the full obsession.

By July 2021, Zuckerberg gave a long interview to Casey Newton at The Verge about Facebook becoming a “metaverse company” and described it as an “embodied internet”. Then, on October 28, 2021, his obsession became the company identity. Zuckerberg announced that Facebook the company was becoming Meta at Connect 2021, saying the new company brand would focus on bringing the metaverse to life.

I can see the logic. As a business strategy, that made sense. As a product ordinary people were expected to use, it was much harder to understand. Zuckerberg did not want Meta/Facebook to be trapped inside someone else’s platform again. Facebook had won on social, but on mobile it remained dependent on Apple and Google for distribution, privacy rules, app-store policies and hardware. The metaverse looked like a chance to own the next operating system of social life: hardware, avatars, identity, payments, meetings, gaming, work, commerce — the whole stack. In his 2021 founder’s letter, he framed the metaverse as the “next chapter of the internet” and said Meta would become “metaverse-first, not Facebook-first.”

Facebook had obviously had its problems — it was scandal-ridden. It had let advertisers target vulnerable teenagers, helped fake news spread, and enabled the spread of hate speech linked to atrocities in Myanmar. Perhaps Zuckerberg was looking for a way out of Facebook, and the metaverse offered that.

What I still didn’t understand was why he didn’t see what the rest of us saw — that it looked terrible and offered no real benefit to users. Then I read Sarah Wynn-Williams’ tell-all book about Facebook, Careless People, and it all started to make sense.

To say the book made my jaw hit the floor on several occasions would be an understatement. It’s an absolute page-turner, and your reactions grow from mild amusement to shock, then disbelief, then absolute outrage the further through the book you get. I’m aware of the criticisms of Wynn-Williams: that it is a book written by a disgruntled employee, and that she dodges a lot of personal responsibility for her part in the various misdeeds of the company. However, in another perfect example of the Streisand effect, the fact that Meta obtained a legal order in the United States to prevent her from saying anything negative about the company — at all — made me want to pick it up, and I’m glad I did.

Because now I get it — Zuckerberg seems to have spent years in an environment where too few people were willing to tell him when his ideas weren’t good. According to Wynn-Williams, he was surrounded by sycophants. When he had bad ideas, like the ill-fated Internet.org, he wouldn’t let them go and persisted with them, even when they were obviously going to fail. The people around him enabled him because he was simply too powerful. They even let him win at the board games he liked to play with them at his house or on his jet, and — crucially — he didn’t notice that they were letting him win. I can imagine that in that environment, nobody inside Meta would want to tell Zuckerberg that his metaverse was the equivalent of the emperor’s new clothes, especially if they wouldn’t even risk beating him at Settlers of Catan.

Wynn-Williams only mentions the metaverse in her epilogue. It happened after she was brutally fired from Facebook. Perhaps selfishly, I wish she’d been there for the metaverse period, because I would love to read firsthand accounts of how and why Zuckerberg persisted with such an obviously bad idea.

Maybe I’m being too harsh on Zuckerberg. The metaverse graphics did get better over time and Apple ventured slightly into the same territory with its Apple Vision Pro, even after the metaverse had turned into a smoldering wasteland. The fact is, people don’t enjoy wearing VR goggles for extended periods of time, and for normal people, VR lacks that one killer app. There doesn’t seem to be anything you can do in a VR space that you can’t do elsewhere much more easily.

The metaverse didn’t really die with a bang, but with a whimper. It faded through layoffs, spending cuts and the AI pivot. If I had to put a date on it, I’d say early 2023 was when Meta’s narrative moved on. In February and March 2023, Zuckerberg started talking about Meta’s “year of efficiency” and announced huge layoffs and cost-cutting. OpenAI had launched ChatGPT in November 2022, and by early 2023, generative AI had swallowed the oxygen that ideas like the metaverse need to survive. Every tech company was talking about AI now, not virtual offices and avatar legs.

The metaverse was over. We all forgot about it and moved on.

I’m glad I read Wynn-Williams’ book, because now I can understand how Facebook let the metaverse happen. And if there’s one thing I learned from reading it, it’s that money and power can bring you a lot of things, but common sense requires neither.

While the AI data center boom is undoubtedly an opportunity for the fiber industry, it also presents something of a challenge.

Sure, investment in network infrastructure is rarely a bad thing. I can’t help, however, getting flashbacks to the early 2000’s - operators pouring billions into fiber, without proven demand.

This resulted in stranded assets, empty capacity, and ultimately, a bust that hampered telecoms for nearly a decade.

This time around, as serious AI momentum continues to grow, with megawatt campuses, GPU clusters, hyperscaler capex announced seemingly every week, the temptation to ‘follow the boom’ is rearing its head again.

I’m optimistic, however, that the industry has learnt its lesson. Not just to avoid overspend, but to be far more targeted about where fiber actually gets built, what kind of fiber is needed, and which partnerships can make new routes commercially viable.

There’s no denying AI demand is there, but it's important operators don’t get caught up in the hype and assume it will be everywhere.

It may sound basic, but the industry needs to read the tea leaves carefully. Data centers have never had the luxury of a ‘build it, and they will come’ approach. The strongest sites tend to sit where demand, power, fiber and customer ecosystems can all be brought together. Things are changing however; data centers are on the move.

Fiber investment therefore, should focus on solid signals, from AI Growth Zones and established data center corridors to cloud on-ramps, internet exchanges and emerging compute clusters. While the latter two have traditionally centered around London (particularly the London Docklands and Slough), the Government’s proposed AI Growth Zones point to a broader regional shift.

Sites in Oxfordshire, the North East, North Wales, South Wales and Lanarkshire in Scotland aim to spread AI infrastructure development away from the capital, bringing data center demand closer to new regional power, land and connectivity ecosystems.

Beyond the Government initiatives investors are also placing bets on other development opportunities outside of the traditional areas.

But even if you do invest in fiber build in all the right places, that’s no longer a guarantee. While location is one aspect (and admittedly, not a ground-breaking one, pardon the pun), there’s a new, arguably even bigger factor that network operators can’t ignore - consumability.

Hyperscalers, neoclouds and AI infrastructure businesses are not always buying connectivity in the same way as traditional telecoms customers. They expect capacity to be identifiable, orderable and scalable at speed. In other words, they want the fiber market to feel more like a platform than a slow procurement exercise.

AI workloads are also pushing future rack-density designs towards 1MW, which places extreme demands not just on power and cooling, but on fiber density and the speed at which capacity can be provisioned.

As these companies scale, providers that can offer API-driven ordering, rapid provisioning, clear visibility of available routes and flexible rerouting will be in the strongest position when capacity decisions are made.

Having fiber in the right place may secure a place in the conversation, but making that fiber easier to consume will increasingly determine who wins the work.

There’s another major factor, however, one that is often overlooked and missed in the media conversation around UK AI infrastructure - backbone connectivity.

As a call back to the opening of this article, AI infrastructure is often viewed as a hardware arms race. With much of the focus falling on megawatts, GPU clusters and hyperscaler capex, with data center capacity treated as a shorthand for infrastructure readiness.

This view missed the wider systems those facilities depend on. Without the right infrastructure backing up development, the UK risks repeating old DC patterns, where new sites sit underutilized due to a lack of customers, or are delayed entirely due to missing fundamental backbone infrastructure. This concern is already starting to bite. According to recent research, 82% of UK DC operators have already delayed new facilities or expansions because of limited access to high-capacity fiber infrastructure.

Take the UK government’s compute ambitions. The UK has said it will need at least 6GW of AI-capable data center capacity by 2030 to support the growing demands of AI. That is a serious statement of intent, but the gap between ambition and deliverability is still understated. The UK’s AI ambitions are often framed in terms of compute capacity, rather than the connectivity and required to make those investments viable.

None of this makes the UK’s AI ambitions unrealistic. But it does mean fiber can’t be treated as an afterthought. Data-center operators, hyperscalers and network providers need to plan connectivity earlier. Developing a clearer view of where capacity exists and where new resilient routes are needed, particularly in more regional locations outside of London or where the landscape is more challenging for development. Alongside how quickly they can be made commercially available.

Interestingly, in recent months we have seen a change in the approach to fiber emerging. Much earlier engagement from the DC developer/operators on fiber availability and timeline to deliver, along with a significant increase in the capacity required from day one, with a much steeper ramp in uptake.

This tells us two things, the forecast in uptake and data movement has shifted, as has the move to further de-risk a development by getting assurance on fiber/connectivity at a much earlier stage.

Check out our guide to the best business cloud storage services.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit