KDDI: unauthorized access to its mail system for ISPs
KDDI disclosed on 23 June that the mail system it provides to internet service providers had been accessed. Third-party software in the system had a vulnerability that even its vendor did not know about at the time, and access began on 16 May. KDDI confirmed it on 17 June and fixed it the same day. Its July report confirmed that email addresses of 12,231,954 people leaked, 7,616,173 of them with passwords. Users of STNet (Pikara), KDDI Web Communications (CPI), JCOM, Chubu Telecommunications (Commufa), NIFTY (@nifty) and BIGLOBE were affected; au, UQ and au one net mail were not.
Disclosed
2026-06-23
Organizations involved
7
Leaked or at risk
12.2M
12,231,954
Downtime
Unknown
Timeline
- Started 2026-05-16
- Detected 2026-06-17
- Disclosed 2026-06-23
- 38 days
Attack or cause
- Method
- [Intrusion]
- Impact
- [Data leak]
- Entry point
- Unknown
Data exposed or at risk
Supply chain
Organizations involved
[Through a supplier][Critical]Tokyo, MinatoInformation and communications
JCOM Co., Ltd.[Breached][Critical]Tokyo, ShinjukuInformation and communications12,231,954 leaked
KDDI Corporation[Through a supplier][Critical]Tokyo, ChiyodaInformation and communications
BIGLOBE Inc.[Through a supplier][Critical]Aichi, Nagoya, NakaInformation and communications
Chubu Telecommunications Co., Inc.[Through a supplier][Critical]Tokyo, MinatoInformation and communications
KDDI Web Communications Inc.[Through a supplier][Critical]Tokyo, MinatoInformation and communications
NIFTY Corporation[Through a supplier][Critical]Kagawa, TakamatsuInformation and communications
STNet, Incorporated
Sources
- [1][Official]ISP 事業者向けメールシステムに対する不正アクセスについての お詫びとご報告KDDI · 2026-07-06
- [2][Official]ISP事業者向けメールシステムに対する不正アクセスの発生についてKDDI · 2026-06-23
- [3][Official]当社メールサービスに対する不正アクセスの発生についてJCOM · 2026-06-23