Lifenet and KDDI: au Life Insurance link system intrusion

1. 2026-10-23

   Lifenet detected unauthorized access to its system linked with KDDI and told KDDI. A third party may have obtained data through a vulnerability in part of the system. [1] [2]

2. 2026-10-24

   KDDI cut the route between the two companies' systems. [2]

3. 2026-10-30

   The two companies published the incident. [1] [2] [3]

Data of up to 22,541 KDDI customers may have leaked: names, postal codes, phone numbers, email addresses, member identifiers and more, with gender and birth dates for some. The most common combination, 8,434 records, is name and postal code plus email address and member identifier. [1] [2] [3]

Passwords, card and bank account data, and the insurance contract data Lifenet holds are not included. KDDI's network and Lifenet's other systems are not affected, and no secondary damage has been found. [1] [2] [3]

Some functions of au Life Insurance, including new applications, are stopped for maintenance with no restart date. The companies will contact affected customers individually and report to the authorities. [1] [2]