KDDI Says Zero-Day Breach Exposed Millions of ISP Customers’ Email Data
Summary
KDDI says attackers exploited a zero-day in third-party software to access an email platform used by five Japanese ISPs, exposing 12,233,087 email addresses and 7,616,173 passwords. Password resets, EDR deployment and a forensic review followed.
Key points
- KDDI said attackers breached the email platform on May 16 by exploiting a zero-day vulnerability in third-party software; the incident was discovered on June 17.
- The platform served customers of STNet, JCOM, Chubu Telecommunications C, NIFTY Corporation and BIGLOBE.
- KDDI reported that email addresses for 12,233,087 people and passwords for 7,616,173 accounts were exposed.
- KDDI said some passwords were hashed or encrypted but did not disclose how many were stored in plaintext or specify the encryption type.
- KDDI is coordinating password changes, including mandatory resets for inactive accounts, and deployed EDR after the breach.
- A forensic audit on June 23 confirmed, according to KDDI, that the exploited vulnerability had been addressed and found no other security issues; the company also notified Japanese authorities.
Article Details
- Victim Organization
- STNet, JCOM, Chubu Telecommunications C, NIFTY Corporation, and BIGLOBE; the breached email platform was used by these ISPs. KDDI disclosed the incident.
- Incident Type
- Data breach following exploitation of a zero-day vulnerability in third-party software.
- Incident Date
- 2026-05-16
- Disclosure Date
- 2026-07-06
- Data Types Exposed
- Email addresses
- Passwords
- Affected Records
- Email addresses of 12,233,087 people and passwords for 7,616,173 accounts were exposed.
- Operational Impact
- Attackers accessed the email platform. KDDI blocked their access, deployed EDR, completed a forensic audit, and coordinated with affected ISPs on security measures. Password changes were underway, including mandatory changes for inactive accounts.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed