KDDI Data Breach Explained: How a Zero-Day Exposed 12 Million ISP Email Accounts

Updated October 30, 2026.

The KDDI data breach of 2026 did not touch au phones or au mail. Instead, it hit something most customers had never heard of: an email platform that KDDI built and runs for other internet providers. A flaw in third-party software inside that platform gave attackers a way into accounts at six Japanese providers, including BIGLOBE, @nifty and J:COM. KDDI later confirmed that 12.2 million email addresses and 7.6 million passwords had leaked. Japan's privacy regulator then found that those 7.6 million passwords had been stored in plain text.

Below: how KDDI was hacked, which ISPs and brands were affected, what the regulators did, what to do if you're affected and the lessons for email security. Figures come from KDDI, the affected providers and Japan's regulators.

KDDI data breach: the short version

• What was hit: a mail platform KDDI developed for internet service providers (ISPs). It handles accounts, sending and receiving, webmail and mail storage for six providers.
• How: attackers exploited a vulnerability in third-party software built into the platform. KDDI says the vendor didn't know about the flaw when KDDI found it, which makes it a zero-day.
• When: unauthorized access began on May 16, 2026 at some ISPs. KDDI confirmed it on June 17 and announced it on June 23.
• How many: KDDI first warned that up to 14.22 million address-and-password pairs might have leaked. Its July count confirmed 12,231,954 email addresses (corrected from 12,233,087) and 7,616,173 passwords.
• Who: customers of BIGLOBE, @nifty, J:COM, Commufa (Chubu Telecommunications), Pikara (STNet) and the CPI rental server (KDDI Web Communications). au mail, UQ mobile mail and au one net mail were not affected.
• Regulators: the communications ministry gave KDDI a written strict warning on July 29. The Personal Information Protection Commission (PPC) issued guidance to KDDI and some of the ISPs on August 19.
• What to do: change your email password, then change the same or a similar password anywhere else you used it.

How was KDDI hacked?

KDDI hasn't named the software or published technical details, so this account sticks to its notices and the regulators' findings.

A shared email platform for ISPs

KDDI, which BleepingComputer describes as Japan's second-largest mobile provider, built a mail platform for internet service providers to run their customers' email on. In its July 6 report, KDDI described it as one system that handles mail accounts, sending and receiving, webmail and mail storage.

That design is efficient, but it also means one weakness reaches every provider at once. Six providers' mail ran on this platform.

A zero-day in third-party software

The attackers got in through a vulnerability in third-party software that KDDI had built into the platform. A zero-day is a flaw the software's maker doesn't know about yet, so no fix exists when attackers start using it. KDDI said the vendor had not been aware of this flaw as of June 17. According to KDDI, the vendor has since reported it to a public agency and is working toward disclosure. None of the reports we reviewed named the vendor or the product.

A month inside before anyone confirmed it

According to KDDI, unauthorized access at some ISPs began on May 16, 2026. KDDI confirmed it on June 17, about a month later.

There were earlier warning signs. Keitai Watch reported that Nifty saw a sudden spike in load on its mail system on May 29, suspected unauthorized IMAP logins and alerted affected users. IMAP is the protocol mail apps use to read a mailbox stored on a server. INTERNET Watch, reporting the communications ministry's findings, said Nifty first contacted KDDI about the problem on June 1.

KDDI modified the system and fixed the vulnerability on June 17, the day it confirmed the intrusion. By June 21 it had installed EDR on every server that controls external communications. EDR, short for endpoint detection and response, is software that watches servers for signs of an attack. A third-party forensic investigation on June 23 found no suspicious traces other than the exploited flaw.

Why plain-text passwords made it worse

Passwords should be stored hashed, meaning scrambled with a one-way function. Then even someone who steals the database can't simply read them. KDDI's first notice said some of the passwords were hashed or encrypted, but many weren't.

The PPC later found that 7,616,173 of the leaked passwords had been stored in plain text. The regulator said a third party holding those credentials could read the contents of the mailboxes. It also said the plain-text storage stemmed from circumstances on the side of some of the providers, and it issued guidance to those providers too. It didn't name them.

Which ISPs and brands were affected?

KDDI's June 23 notice listed six providers and their mail services:

• STNet: mail for Pikara Hikari, Pikara Mobile and Oshigoto Pikara
• KDDI Web Communications: mail for the CPI rental server
• JCOM: J:COM NET mail, plus the mail service it provides for cable TV operators
• Chubu Telecommunications (ctc): Commufa Hikari and Business Commufa mail
• NIFTY: @nifty mail
• BIGLOBE: BIGLOBE mail

Some English-language coverage says "five ISPs." That count covers the five outside operators and leaves out KDDI Web Communications, which is part of the KDDI group. Either way, six providers' services ran on the platform.

KDDI said its own consumer mail for mobile and fixed lines (au mail, UQ mobile mail and au one net mail) runs on separate equipment and suffered no impact or leak. So if you searched for an "au email leak," the answer is no: au addresses were not part of this breach.

The counts include canceled and dormant accounts, so an old BIGLOBE or @nifty address you stopped using may still be among them.

What was exposed: the KDDI password leak in numbers

Three numbers circulate, and each measures something different:

• 14.22 million was KDDI's June 23 upper limit for email address and password pairs that might have leaked. It included canceled and dormant accounts and was meant as a maximum while the investigation continued.
• 12.2 million is the number of people whose email addresses were confirmed leaked. KDDI's July 6 report gave 12,233,087, and a July 21 update corrected the figure to 12,231,954. The PPC used the corrected figure.
• 7.6 million (7,616,173) is the number of people whose passwords were confirmed leaked. These people are included in the 12.2 million.

What leaked was login data: the email address, which doubles as the login ID, and the password. Because so many passwords were readable, the communications ministry said third parties could have viewed up to about 7.62 million mailboxes. On that basis it treated the case as a breach of the secrecy of communications under Japan's Telecommunications Business Act, Keitai Watch reported.

As of July 29, no misuse of the leaked data had been confirmed, Kyodo News reported. That isn't proof that none happened. Stolen email passwords are often used quietly, and an inbox that can be read may hold password-reset links, invoices and copies of IDs.

What Japan's regulators did

Two regulators acted, and neither announced a fine. Both used administrative guidance: formal instructions to improve, paired with orders to report back.

The communications ministry: a report order, then a strict warning

On June 24, the Ministry of Internal Affairs and Communications (MIC) ordered KDDI to file a report under Article 166(1) of the Telecommunications Business Act. The ministry asked for the cause, the scope, KDDI's response, how affected users were being handled and how KDDI would prevent a repeat. The report was due July 6, and KDDI filed it that day.

At a June 26 press conference, Communications Minister Yoshimasa Hayashi called the impact on users "very regrettable" and said preventing secondary harm was important, Kyodo reported.

On July 29, MIC gave KDDI written guidance that included a strict warning. According to INTERNET Watch and Keitai Watch, the ministry made three findings:

• The layered defenses a mail system should have did not work effectively.
• The fact that leaked passwords had been stored without encryption or other safeguards was something it "cannot overlook."
• Taking 22 days from one provider's first report to the public announcement was not a prompt response.

MIC also told KDDI to:

• re-examine the system's layered defenses;
• improve its ability to respond to incidents;
• check how information is shared, both internally (including with management) and with outside operators;
• strengthen its organization.

KDDI had to report on its progress and on any secondary harm by August 31, and then every quarter for a year. Kyodo reported that KDDI President Matsuda received the document in person and said the company takes it seriously and will do its utmost to prevent a repeat.

The privacy regulator: guidance for KDDI and some ISPs

On August 19, the PPC issued guidance to KDDI under Article 147 of the Act on the Protection of Personal Information (APPI). Its release made three main points:

• The risk was known. KDDI built the system to serve several providers, many users relied on it and it stored many passwords in plain text. Given those risks, KDDI needed layered measures to stop an attacker from spreading after getting in and to limit the damage.
• The safeguards fell short. KDDI hadn't taken enough access-control and related measures, so its technical safeguards fell short of the PPC's guidelines.
• A deadline was set. KDDI must improve its safeguards and, with supporting documents, report by October 19, 2026 on its prevention measures and any secondary harm.

The PPC also issued guidance to "some providers," because it found the plain-text storage stemmed from circumstances on their side. Alongside the guidance, it published a warning to everyone who used the affected mail services. That warning is covered in the next section. Whether KDDI's October 19 report will be published wasn't clear from the sources we found.

What to do if you're affected by the KDDI breach

The providers forced password resets in late June and July on accounts that hadn't been updated, so your old email password probably no longer works there. The bigger risk now is everywhere else you used it.

The PPC's warning is specific: if you used the same or a similar password on any other service, change it there quickly. Attackers try leaked email and password pairs on other sites in what's called a credential-stuffing attack (the PPC calls it a "list-type attack"). The word "similar" matters, because a password with only a small change can still be easy to guess.

If you run a business or work in a public office, the PPC asks you to make sure your staff know this too.

Lessons for email security

The KDDI breach makes a clear case study, because the regulators spelled out what went wrong. Five lessons stand out.

1. Shared platforms share their failures. Running mail for six providers on one platform spared each of them from running its own. It also meant a single flaw in one third-party component reached about 12 million people across all six.

2. Plain-text passwords turn a breach into a takeover. Had every password been properly hashed, the attackers would have taken away mostly email addresses. Instead, millions of inboxes became readable. Both regulators came back to this point.

3. Plan for the perimeter to fail. A zero-day is hard to stop by definition. The regulators' criticism focused on what came after the break-in: weak access controls and missing layers that could have contained an intruder. KDDI finished rolling out EDR to all its external-facing servers only after the breach was found.

4. Early signals need an owner. Nifty saw unusual load on May 29 and contacted KDDI on June 1. KDDI confirmed the intrusion on June 17. When a platform is shared, someone has to be responsible for connecting odd signals from different customers, and doing it fast.

5. Old mail habits are part of the risk. KDDI says it will work with the ISPs to move early to communication standards with stronger security, while weighing the impact on customers who use traditional mail software. It also plans a full review of the vendor software's design documents and code, using AI among other tools, to look for other hidden flaws.

For individuals, the lesson is older and simpler: your email account is the key to most of your other accounts. Give it a unique password, turn on two-factor authentication where your provider offers it and never reuse that password anywhere else.

How the KDDI breach fits a bad year for Japanese ISPs

The KDDI incident wasn't the last breach at a Japanese internet provider in 2026. In late October, Sony disclosed that an outsider had accessed the So-net member database, exposing up to 2,585,481 records, including 54,401 email passwords for add-on mail services. We cover that incident in our Sony data breach explainer.

In both cases, email credentials ended up in an intruder's hands.

KDDI data breach FAQ

Was KDDI hacked in 2026?

Yes. KDDI confirmed on June 17, 2026, that attackers had broken into the email platform it runs for internet service providers, and it announced the breach on June 23. The attackers used a previously unknown flaw, a zero-day, in third-party software inside that platform. Access had begun at some providers on May 16. KDDI's own au mobile mail was not affected.

Was au mail affected by the KDDI data breach?

No. KDDI says au mail, UQ mobile mail and au one net mail run on separate equipment and suffered no impact or leak. The breach hit the mail platform KDDI provides to other ISPs: BIGLOBE, @nifty, J:COM, Commufa, Pikara and the CPI rental server. If your address ends in au.com or ezweb.ne.jp, it wasn't part of this incident.

How many people were affected by the KDDI data breach?

KDDI confirmed that the email addresses of 12,231,954 people leaked, a figure corrected on July 21 from 12,233,087. For 7,616,173 of them, passwords leaked too. KDDI's first estimate of up to 14.22 million was an upper limit that included canceled and dormant accounts. BIGLOBE had the most affected users, with about 5 million addresses.

Were the KDDI passwords encrypted?

Many weren't. Japan's privacy regulator found that 7,616,173 of the leaked passwords had been stored in plain text, so anyone holding them could read those mailboxes. KDDI's first notice said some passwords were hashed or encrypted. The regulator said the plain-text storage stemmed from circumstances at some of the providers and issued guidance to those providers as well.

Who hacked KDDI?

KDDI hasn't said, and none of the reports we reviewed named a group. What is known is the method: a zero-day vulnerability in third-party software built into the mail platform. KDDI says the software vendor reported the flaw to a public agency and is working toward disclosing it. Treat any attribution you see online as unconfirmed unless it comes from KDDI or the authorities.

Did KDDI get fined for the data breach?

No fine was announced. The communications ministry issued written guidance with a strict warning on July 29 and required quarterly reports for a year. The Personal Information Protection Commission issued guidance on August 19 and asked for a report by October 19, 2026. Both actions require changes and reporting rather than a financial penalty.

How do I check if my password was leaked in the KDDI breach?

The affected providers posted notices and forced password changes on accounts that hadn't been updated. Check your provider's official notice by typing its web address yourself rather than clicking an email link. If you used your old email password anywhere else, assume it's exposed and change it there. A password manager's security check can help you find reused passwords.

Cleus is an uncensored AI agent that searches the web live, so it can tell you what has changed since this article was written.

Sources

• KDDI: Unauthorized access to the mail system for ISPs (June 23, 2026 press release, Japanese, PDF)
• KDDI: Apology and report on the unauthorized access (July 6, 2026, updated July 21; Japanese, PDF)
• Personal Information Protection Commission: Administrative response to KDDI and ISPs, and warning to mail service users (August 19, 2026; Japanese, PDF)
• Ministry of Internal Affairs and Communications: Request for a report from KDDI (June 24, 2026; Japanese)
• BleepingComputer: Data breach exposes up to 14.2 million email logins at six ISPs
• BleepingComputer: Japanese telecom giant KDDI says data breach affects 12 million people
• The Record: Major Japanese telco says cyberattack exposed 12 million emails
• SecurityWeek: 12 million impacted by data breach at Japanese telco KDDI
• Infosecurity Magazine: KDDI breach affects six Japanese ISPs
• MLex: Japan's PPC instructs KDDI over data leak involving 12.2m users
• Keitai Watch: Per-provider leak counts from the six ISPs (July 7, 2026; Japanese)
• Impress Watch: KDDI confirms 12.23 million addresses leaked (July 6, 2026; Japanese)
• Impress Watch: KDDI announces the breach and the six affected ISPs (June 23, 2026; Japanese)
• INTERNET Watch: MIC issues written guidance to KDDI (July 30, 2026; Japanese)
• Keitai Watch: MIC guidance, about 7.62 million affected (July 30, 2026; Japanese)
• ScanNetSecurity: JCOM reports 2,593,076 leaked addresses (July 14, 2026; Japanese)
• ScanNetSecurity: PPC issues guidance over the KDDI mail system breach (August 24, 2026; Japanese)
• Kumamoto Nichinichi Shimbun (Kyodo): Minister calls KDDI mail leak "regrettable" (June 26, 2026; Japanese)
• Kumamoto Nichinichi Shimbun (Kyodo): MIC gives KDDI a strict warning (July 29, 2026; Japanese)