KDDI Confirms Email-System Breach Affecting 12.23 Million Users
Summary
KDDI says attackers exploited a software vulnerability in its email system, affecting 12.23 million email users and exposing 7.61 million passwords, some stored in plaintext. The company patched the flaw and urged password resets.
Key points
- KDDI says the breach affected six downstream email providers that use its infrastructure.
- The incident involved 12.23 million email addresses and 7.61 million passwords, according to the article.
- Some passwords were stored in plaintext; KDDI did not disclose how many.
- KDDI attributed the intrusion to exploitation of a software vulnerability in its foundational email system.
- The article says signs of compromise date to May 16, 2026, and KDDI detected unauthorized access on June 17.
- KDDI patched the system and urged users to reset passwords, warning about phishing and credential stuffing.
Article Details
- Victim Organization
- KDDI
- Incident Type
- Confirmed data breach following exploitation of a software vulnerability in KDDI's foundational email system
- Incident Date
- 2026-05-16
- Disclosure Date
- 2026-06-23
- Data Types Exposed
- Email addresses
- Passwords, including some stored in plaintext and others hashed and salted
- Affected Records
- Approximately 12.23 million email addresses and 7.61 million passwords; the exact number of plaintext passwords was not disclosed.
- Operational Impact
- The attack affected six downstream email service providers using KDDI's infrastructure. KDDI patched the vulnerability and mandated password resets. The article does not report service disruption.
- Claim Status
- confirmed