KDDI email-platform breach exposes 12.2 million people’s addresses and 7.6 million passwords
A breach of KDDI’s shared email platform exposed 12,231,954 people’s addresses, including passwords for 7,616,173. Customers of six Japanese providers should follow their provider’s reset instructions and replace reused passwords.
If you use an affected email service and have not changed its password since the breach, follow your provider’s reset instructions now, including for old accounts. Replace that password anywhere else you reused it, and enable two-factor authentication wherever your provider offers it.
What’s happening
Attackers breached KDDI’s shared email platform through a previously unknown flaw in third-party software. It served STNet’s Pikara services, CPI, J:COM NET and cable providers, Commufa, @nifty and BIGLOBE Mail. Current, former and dormant accounts were potentially affected. KDDI’s corrected figures confirm exposure of 12,231,954 people’s email addresses, including passwords for 7,616,173 of them. KDDI says it modified the platform on 17 June to stop further damage; customers still needed password changes. Its own au Mail, UQ mobile Mail and au one net Mail services were unaffected. On 29 July, Japan’s communications regulator criticised password storage and delayed disclosure, and required continuing reports. As of 3 November, the reviewed sources do not confirm that every required password reset was completed. KDDI’s statements do not identify the software or a CVE.
- What
- Breach
- Affects
- KDDI-hosted email services for STNet, CPI, JCOM, Chubu Telecommunications, Nifty and BIGLOBE
- Fixed in
- Nothing to patch
- Since
- 23 June 2026
- Closed
- 29 July 2026
Timeline
- Update
Japan’s communications ministry issued administrative guidance, criticising unprotected password storage and the 22-day disclosure delay after the initial warning. It required a report by 31 August and quarterly reports for a year.
- Vendor revised
KDDI corrected the email-address exposure count to 12,231,954 people. The password exposure count remained 7,616,173, a subset of that total.
- Update
CPI said it had finished identifying affected customers and would email them individually by 10 July. It also advised changing passwords reused on other services.
- Vendor revised
KDDI confirmed exposure of 12,233,087 people’s email addresses and passwords for 7,616,173 of them. It said providers were working towards forced password changes within one or two days; this was a target, not confirmation of completion.
- Made publicNothing to patch
KDDI publicly disclosed possible exposure of up to 14.22 million email accounts across six providers: STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty and BIGLOBE. Former customers and dormant accounts were included.
- Update
KDDI confirmed the intrusion and modified the email platform that day to prevent further damage, implementing technical defensive measures.
- Update
Nifty first alerted KDDI to the incident, according to INTERNET Watch’s later account of the regulator’s findings.
- Update
Unauthorised access began against some providers using KDDI’s email platform. Attackers exploited a third-party software flaw that its maker did not yet know about.
Sources
- Unauthorised access to the ISP email system: apology and report, corrected 21 JulyKDDI · 21 July 2026
- Unauthorised access to the ISP email systemKDDI · 23 June 2026
- Report and apology concerning unauthorised access to CPI email servicesCPI · 7 July 2026
- Telco giant KDDI says data breach affects over 12 million peopleBleepingComputer · 8 July 2026
- Data breach exposes up to 14.2 million email logins at six ISPsBleepingComputer · 28 June 2026
- Communications ministry issues administrative guidance to KDDI over ISP email breachINTERNET Watch · 30 July 2026