KDDI says a breach may have exposed email addresses and passwords for up to 14.2 million ISP accounts across six providers.