On June 17, 2026, KDDI confirmed a data breach affecting over 12 million individuals due to exploitation of a zero-day vulnerability in a third-party system integral to the email infrastructure used by five ISPs (STNet, JCOM, Chubu Telecommunications, NIFTY, and BIGLOBE). The attackers accessed email addresses and passwords of millions of users. KDDI's mobile and fixed-line internet email services remained unaffected. The company has removed the attackers from its systems, is collaborating with affected ISPs to enforce password resets, and is developing a patch for the zero-day vulnerability. KDDI is also inspecting the involved software for additional vulnerabilities and plans to enhance security by transitioning to more secure communication technologies.

The breach compromised the email addresses of approximately 12.2 million people and passwords of 7.6 million individuals associated with ISP email services. This exposure risks unauthorized access to affected email accounts. However, KDDI's core mobile and fixed-line internet email services were not impacted. Immediate remediation actions, including password resets, have been initiated to mitigate further unauthorized access. There is no evidence of additional suspicious activity following the incident.

KDDI is actively working with affected ISPs to enforce mandatory password resets for all impacted email accounts. The company has evicted the attackers and is developing an official patch for the exploited zero-day vulnerability. Users should follow password reset instructions provided by their ISPs. KDDI is also conducting thorough software inspections to identify and remediate any other vulnerabilities and plans to transition to more secure communication technologies. Patch status is not yet confirmed — check KDDI advisories for updates on the patch release.