Breaches and incidentsBriefReported by a reputable outlet, citing the company
KDDI and five other Japanese ISPs: zero-day in third-party software on a shared email platform exposes 12.2 million addresses and 7.6 million passwords
KDDI said attackers breached an email system it operates for itself and five ISPs (STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE) on 16 May 2026.
- Disclosed
What happened
- KDDI said attackers breached an email system it operates for itself and five ISPs (STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE) on 16 May 2026; discovered 17 Jun. 12,233,087 email addresses and 7,616,173 passwords were accessed (up to 14.22 million accounts potentially exposed). Some passwords were hashed or encrypted; KDDI did not say how many were not.
- Root cause: a zero-day in unnamed third-party software that the vendor had not recognized as of 17 Jun; the vendor reported it to authorities.
- No attacker identified.
- Password changes forced, EDR deployed, PPC and MIC notified.
Sources
- https://www.bleepingcomputer.com/news/security/data-breach-exposes-up-to-142-million-email-logins-at-six-isps/
- https://www.bleepingcomputer.com/news/security/japanese-telecom-giant-kddi-says-data-breach-affects-12-million-people/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.