KDDI ISP 2026 Data Breach
The KDDI ISP 2026 data breach resulted from exploitation of a third-party software flaw in the shared email platform KDDI developed for internet service providers.
Exposed Data Types
2- Email addresses
- Passwords
About This Breach
KDDI's official July 6 report, updated July 21, reports 12,231,954 people whose system-created email addresses were exposed and 7,616,173 people within that group whose system passwords were exposed. The password measure is a subset of the email scope and the two figures are not added.
Event timeline and cause
According to the official report, unauthorized access began at some ISPs on May 16, 2026. KDDI confirmed the event on June 17, modified the system that day to contain the suspected point, and applied technical defenses. It made its first public announcement on June 23; Japan's communications ministry requested a report under the Telecommunications Business Act on June 24, and KDDI submitted its detailed report on July 6.
The access exploited a vulnerability in third-party software used as part of the platform. The software provider did not know about the flaw when KDDI confirmed the event on June 17 and subsequently began the public-authority notification and disclosure process. KDDI did not disclose the software name, a CVE, the actor, or further details of the precise access method.
Which data and services are in scope?
The confirmed classes are email addresses and passwords. The 12,231,954 value is the official report's scope for people whose email addresses were exposed; it is not a count of unique raw rows or local records. The 7,616,173 value is the subset of that group whose passwords were exposed. Names, phone numbers, postal addresses, payment data, government IDs, and email contents are not listed as confirmed fields in the report.
Independent reporting identifies STNet, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE as the five providers using the platform. KDDI's au Mail, UQ mobile Mail, and au one net Mail services ran on separate equipment and were unaffected according to the official report. A KDDI domain or brand alone does not establish that a particular mailbox falls within the event.
Local coverage and response
Production has no import job or local person-level data for this event, and every email, password, and other linked-data collection contains zero records. The external company scope is not presented as a local search result, unique-email dataset, or locally stored password count.
KDDI deployed EDR to servers controlling external communications by June 21 and said a June 23 third-party forensic review found no suspicious trace beyond the disclosed flaw. It coordinated password changes with affected ISPs and planned mandatory resets for remaining accounts. Customers who receive a notice can open the provider's address directly and choose a new, unique password; any copy of the old password reused on another service can also be changed. Unexpected reset messages should be verified through a known official channel without using the link in the message.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
