One email platform was breached, and 12.23 million users of six internet providers were hit together

At a glance

The KDDI data breach of 2026 started at a single email platform that the Japanese telecom company KDDI (KDDI株式会社) built and provided to six internet service providers (ISPs). Most of the 12.23 million people whose email addresses leaked never chose KDDI; their provider did, and about 7.62 million of them had mailboxes that could be opened, because their passwords were stored in plain text (according to Japan's telecom ministry and its privacy regulator). If your company's email runs on an ISP or a rental server, check today how your passwords are stored and reused, which accounts nobody uses, and who tells whom when something goes wrong.

Some context for readers outside Japan: in Japan, the email address that comes with a home internet contract, called ISP email, is still widely used, including by small businesses. So this was a Japan ISP email breach that reached six providers at once through one shared platform.

This article covers only the attack on KDDI's email system for ISPs, announced on June 23, 2026. It is a separate case from the one KDDI announced on October 30, 2026, in which KDDI customer information may have leaked through unauthorized access to systems at Lifenet Life Insurance (ライフネット生命保険).

When

• Unauthorized access began at some providers on May 16, 2026.
• KDDI confirmed it on June 17 and fixed the system the same day. It announced the breach together with the six providers on June 23.

Who

• The company that built the system: KDDI.
• The six companies that sold email under their own names on top of it: BIGLOBE (ビッグローブ), @nifty (ニフティ), J:COM (JCOM), Commufa Hikari (コミュファ光, run by Chubu Telecommunications), Pikara (ピカラ, run by STNet), and CPI (a rental server service of KDDI Web Communications).
• Users of email that J:COM wholesaled to local cable TV companies are also among the victims.
• KDDI's own mobile email (au mail and UQ mobile mail) runs on separate equipment and was not affected.

What leaked and how much

• Email addresses of 12,231,954 people (about 12.23 million) and passwords of 7,616,173 people (about 7.62 million), using KDDI's corrected figures of July 21. The password group is part of the address group.
• The first figure on June 23, "up to 14.22 million records," was a maximum that included cancelled and dormant accounts. It was not a final count.
• No notice lists names, home addresses or card numbers as leaked. But for people whose mailboxes could be opened, the mail and attachments inside are the problem.

Why (official statements only)

• KDDI says software from another company, built into the system, had a vulnerability (a security weak spot). The vendor of that software did not know about it either.
• The product name, the vendor name and the vulnerability number have not been made public.
• The Ministry of Internal Affairs and Communications (MIC, the ministry that regulates telecoms) found that several security problems overlapped. It singled out passwords stored in plain text, meaning in their original letters, unchanged. Because of that, the leaked passwords could open the mailboxes of about 7.62 million people.

Where things stand now

• Each provider forced password changes or disabled old passwords. CPI announced on August 24 that its response was "complete."
• MIC gave KDDI a written strict warning on July 29. The Personal Information Protection Commission (PPC, Japan's privacy regulator) gave guidance to KDDI and some providers on August 19.
• I could not find public figures for how many mailboxes were actually opened, how many unauthorized logins happened, or what KDDI reported afterward.

If you use ISP email from one of these six providers

• The affected email is the email the six providers above offered on KDDI's platform. au mail and UQ mobile mail were not covered.
• If you used the same or a similar password on other services, the PPC asks you to change it there right away.

What to check in your own company today

1. Is your company email from BIGLOBE, @nifty, J:COM, Commufa Hikari, Pikara or CPI? If so, was it subject to a forced change or a disabled password?
2. Did anyone use that email password on other services, such as cloud tools, online banking or an online store's admin screen? If so, change those too, now.
3. Have you told every employee to check for password reuse? The PPC asked businesses to do this.
4. Are customer data, contracts or password reset emails piling up inside your mailboxes?
5. Have you asked your email and server providers how they store passwords?
6. Do you have written password rules for the company (a different password for each service, two-step verification or passkeys, change at once if a leak is suspected)?

What exactly happened?

Here is the order of events. (Quotes from Japanese documents in this article are my own English renderings.)

• May 16, 2026 Unauthorized access began at some providers. J:COM also said its side was hit from May 16 (KDDI report¹, J:COM²).
• May 24 Unauthorized access began on the @nifty side. NIFTY learned this later from KDDI (NIFTY³).
• June 1 NIFTY judged that there might be unauthorized access and contacted KDDI first (same notice).
• June 8 The impact on CPI began. June 14 to 17: STNet, which runs Pikara, saw unauthorized access to its information (CPI⁴, STNet⁵).
• June 17 KDDI confirmed the unauthorized access and fixed the system the same day.
• June 18 to 21 KDDI informed the providers one by one.
• June 23 KDDI and the six providers announced it on the same day. The figure at this point was "up to 14.22 million records" (KDDI, June 23⁶).
• June 24 MIC required KDDI to report under the Telecommunications Business Act (MIC⁷).
• July 6 KDDI submitted its report to MIC and published final figures. Each provider also published its own figures.
• July 21 KDDI corrected the number of email addresses to 12,231,954 people.
• July 29 MIC gave KDDI written administrative guidance, a strict warning (MIC document⁸).
• August 19 The PPC gave guidance to KDDI and some providers (PPC⁹).

KDDI explains the cause this way. The platform it built for ISPs handled account management, sending and receiving mail, webmail and mail storage in one system. Software from another company, built in as part of that system, had a vulnerability, and as of June 17 the vendor of that software did not know about it (KDDI report¹). The product and vendor names have still not been made public.

CPI's report shows a little more of the path. The attacker got into "server A," used the vulnerability there, and took address information tied to mailboxes from "server B" (CPI report¹⁰).

KDDI's own mobile email (au mail, UQ mobile mail and au one net mail) is built on separate equipment, and KDDI says it was not affected.

How many accounts were affected by the KDDI breach?

KDDI has two final figures for the whole platform (KDDI report¹):

• Email addresses: 12,231,954 people
• Passwords: 7,616,173 people (part of the address group)

What leaked was email addresses and passwords. BIGLOBE said BIGLOBE IDs leaked too. Names, home addresses, card numbers and similar data do not appear as leaked items in any notice from KDDI or the providers.

The KDDI email breach reached the customers of six companies that sold email on KDDI's platform. Reports of a BIGLOBE breach or an @nifty breach are about this same case. Here is what each company published. The companies count in different units, so I kept each figure as it was announced.

• BIGLOBE (ビッグローブ): email addresses and BIGLOBE IDs of 5,016,432 people, and passwords of 4,631,775 of them. Only about 18% of the affected accounts had used email in the last two months. Accounts that were almost never used were hit too (BIGLOBE¹¹).
• @nifty (NIFTY, ニフティ): email addresses of 2,248,708 people, and passwords of 1,862,462 of them (NIFTY³).
• J:COM (JCOM): J:COM NET email addresses of 2,473,191 people (no password leak confirmed). For the email it wholesales to cable TV companies: email addresses of 118,752 people (corrected July 21), and passwords of 1,257 of them. This matters because customers of local cable TV companies that do not carry the J:COM brand are victims too (J:COM²).
• Commufa Hikari (Chubu Telecommunications, 中部テレコミュニケーション, ctc): email for Commufa Hikari and for Business Commufa, its service for companies. Email addresses of 727,176 people, and passwords of 724,344 of them. Almost everyone lost their password too (ctc¹²).
• Pikara (STNet, 株式会社STNet): 397,152 customers, and 456,159 records of email addresses and passwords. One person can hold several addresses, so there are more records than customers. STNet states that corporate customers are included (STNet⁵).
• CPI (KDDI Web Communications, KDDIウェブコミュニケーションズ): a rental server that companies use for their website and company email. 1,250,543 records of mail account information. For the Business Standard and KWC Mail plans, passwords were kept as hashes (values converted so the original letters cannot be read back), and CPI stated that the passwords themselves were not leaked (CPI⁴).

No company published a separate count for business customers. Still, STNet's figures, ctc's business email, BIGLOBE's dedicated desk for corporate customers and CPI's rental servers make it clear that companies were among the victims.

Why did 14.2 million become 12.23 million?

There are four reasons the numbers differ from article to article.

1. Different dates. The June 23 figure, "up to 14.22 million records," was a maximum that included cancelled and dormant accounts, and passwords that were hashed or encrypted (KDDI, June 23⁶). The final figure on July 6 was 12,233,087 people, and the corrected figure on July 21 was 12,231,954 people. Articles from before July 21 use the uncorrected number.
2. Different units. BIGLOBE, NIFTY, J:COM and ctc count people. STNet gives both people and records. CPI counts records. Some articles reported the same CPI number as people.
3. Different ways of reading the notices. J:COM lists 2,473,191 people for J:COM NET and 118,752 people for the cable TV email separately. One article headline used a J:COM number that does not appear in J:COM's notice.
4. Different agencies, different wording. MIC's "about 7.62 million people," the PPC's 7,616,173 people and KDDI's 7,616,173 people with leaked passwords all point to the same group.

So this article uses only KDDI's final figures and the figures each company wrote in its own notice. I did not add up the provider figures to make a total of my own.

Why were mailboxes readable?

The PPC says the passwords of 7,616,173 people were stored in the system in plain text. Anyone who took them could log in with those addresses and read what was inside the mailboxes (PPC⁹).

MIC describes the same group as "about 7.62 million people." It treated this as a leak of the secrecy of communications, the legal duty in Japan to protect the content of other people's messages (MIC document⁸).

The government's view of the cause was harsher than KDDI's.

• MIC: it was not one vulnerability alone. "Several security problems overlapped," and layered defense (a setup where, if one point is broken, the next layer stops the attacker) did not work as it should. MIC called the storage of passwords without safeguards such as encryption "impossible to overlook" (看過できない) (MIC document⁸).
• PPC: even though many passwords were stored in plain text, access controls to stop an intruder from spreading to other servers were not enough. The PPC said the plain-text storage came from "circumstances on the side of some providers," without naming them (PPC⁹).

A mailbox can hold mail with business partners, contract attachments and password reset emails for other services. Who opened which mailbox, and how many were actually opened, has not been made public.

How did KDDI, the providers and the regulators respond?

KDDI fixed the system on June 17. On June 21 it installed EDR (software that watches for and stops suspicious activity inside a server) on all servers that handle external communication. KDDI said that on June 23 a forensic investigation (a search for traces of intrusion) by an outside specialist organization confirmed there were no suspicious traces other than this vulnerability. Going forward, it says it will use AI and other tools to analyze software design documents and programs, and move to communication standards with stronger security (KDDI report¹).

The providers made users change their passwords.

• NIFTY: passwords not changed by midnight at the start of June 26 were disabled one after another. People who did not change them could no longer use their email (NIFTY³).
• BIGLOBE: it reset the passwords of people who did not change them, and set up a separate desk for corporate customers (BIGLOBE¹¹).
• ctc and STNet: they forced password changes. STNet mailed new passwords to Pikara Hikari customers (ctc¹², STNet⁵).
• J:COM: for customers whose addresses alone leaked, it did not reset passwords. It asked customers to change to a strong password themselves (J:COM²).
• CPI: on July 21 it forced a change for Business Standard and KWC Mail users who had not changed their passwords, and on August 24 announced that its response was "complete" (CPI⁴).

A forced change means staff have to type the new password into the mail apps on their PCs and phones again. For a company, work stops for that long.

MIC gave KDDI a strict warning in writing on July 29. It asked KDDI to review its layered defense, recheck its first response and its reporting to management, and check how it shares information with the providers. It asked for a first report by August 31 and then a report every quarter for at least one year (MIC document⁸). On the 22 days from the first report by the provider that first noticed the problem to the public announcement, MIC wrote that it was "hard to call a prompt response" (迅速な対応とは言い難い). According to Kyodo News, KDDI President Hiromichi Matsuda (松田浩路) said the company takes this seriously and will do its utmost to prevent a recurrence (report¹³).

The PPC on August 19 asked KDDI to report by October 19 on how its measures to prevent a recurrence were going (PPC⁹). I could not find in public sources whether the August 31 and October 19 reports were submitted, or what they said.

Why is it risky to reuse a password?

The PPC told users to check right away whether they had used the same or a similar password on other services, and if so, to change those passwords to strong ones. The reason is list-based attacks, also called credential stuffing: attackers take lists of IDs and passwords obtained somewhere else and try them on many services. The PPC also asked businesses to make sure all their staff are told (PPC⁹).

On June 26, the Council of Anti-Phishing Japan (フィッシング対策協議会) issued an urgent alert about phishing emails that appeared to have been sent by misusing the login details of Japanese ISP accounts. The subject lines pretended to be about VISA card restrictions, Amazon account restrictions and delivery problems. On June 29, it added that no direct link to the KDDI case had been confirmed (Council of Anti-Phishing Japan¹⁴). According to Kyodo News, no misuse had been confirmed as of July 29, and no later figures on secondary damage have been published (report¹³).

Many companies and people use one password in many places. That is why one leaked password puts other places at risk. If the password for your company website or your online store's admin screen is the same as your company email password, then the moment the email leaks, those other doors open too.

To stop password reuse, I recommend writing these three rules down as company rules.

1. Use a different password for each service.
2. Use two-step verification (a second check on top of the password) or passkeys (logging in with your own device instead of a password).
3. If a leak is suspected, change the password at once.

Was AI used in this attack?

There is no official announcement or report that AI was used in this case. When KDDI wrote that it will use "AI and other tools," it meant a defensive plan to analyze design documents and programs in the future. It was not about the attackers.

But what people call AI cyber attacks, attackers using AI to find weak points and even build the attack, are already a confirmed capability.

• Anthropic said that in its evaluation of Claude Mythos Preview, the model found thousands of high-severity vulnerabilities in major operating systems and web browsers. Anthropic has not released this model to the general public (Anthropic Glasswing¹⁵, Mythos Preview¹⁶).
• Security company Wiz said it used AI to find "PHP2Shell," a remote code execution vulnerability in the PHP engine (Wiz¹⁷). Amazon said it had already seen attempts to exploit it four days before the vulnerability was made public (AWS¹⁸).
• In the same October, GMO Cybersecurity by Ierae (GMOサイバーセキュリティ byイエラエ) reported finding ARTEX, an AI penetration-testing tool, on attack infrastructure aimed at about 20 Japanese companies. That report does not name the targeted companies and does not mention the KDDI case (GMO Cybersecurity by Ierae¹⁹).

The KDDI case began with a vulnerability that even the vendor did not know about. Finding weak spots like that is getting faster with AI. My view is that even systems we have trusted and used for years can now be examined piece by piece, as if under a magnifying glass.

So I think we should prepare on the assumption that people with bad intent are using this kind of AI. I am not saying AI was used in this case. I mean it is time to drop the assumption that "we have been safe so far."

What does this mean for your business?

My reading is that the root of this case is trust. The six providers took the email platform built by KDDI, a larger company above them, and used it as part of their own business. I think they believed it would of course be fine, used it without much thought, and then this happened. The email and servers your company uses may rest on the same kind of trust.

I see four lessons in this case.

• You can be a victim even if you never built the email system. Customers of the six companies never chose KDDI. The company you chose may itself be running on another company's platform.
• How passwords were stored decided how bad the damage was. For the CPI plans that kept hashes, CPI stated that the passwords themselves were not leaked. For the about 7.62 million people whose passwords were in plain text, the mailboxes could be opened (how many were actually opened has not been made public). Hash or plain text is a very basic question. My guess is that plain-text storage left over from an older system, built when people paid less attention to security, stayed in place and made the accident bigger. This is only my guess. The PPC said only that the plain-text storage came from "circumstances on the side of some providers."
• Unused accounts are victims too. The first figure included cancelled and dormant accounts, and only about 18% of BIGLOBE's affected accounts had been used in the last two months. If you still keep the email of people who left, or an old inquiry address, now is the time to clean them up.
• How fast you tell people is judged too. MIC said the 22 days were hard to call a prompt response. Your company should also decide in advance who tells whom, and when, if an incident happens.

And put the three password rules from the section above in writing for your company.

What happened (based on official announcements)

• May 16, 2026: Unauthorized access begins at some providers (KDDI). J:COM's side is also hit from May 16. — KDDI¹, J:COM²
• May 24, 2026: Unauthorized access begins on the @nifty side (as KDDI later reported to NIFTY). — NIFTY³
• June 1, 2026: NIFTY judges that there may be unauthorized access and contacts KDDI. — NIFTY³
• June 8, 2026: The impact on CPI begins. — CPI⁴
• June 14 to 17, 2026: Unauthorized access to STNet (Pikara) information. — STNet⁵
• June 17, 2026: KDDI confirms the unauthorized access and fixes the system the same day. The vulnerability was unknown even to the vendor. — KDDI¹
• June 18, 2026: J:COM receives KDDI's first notice (formal report on June 21). — J:COM²
• June 20, 2026: STNet receives KDDI's report. — STNet⁵
• June 21, 2026: BIGLOBE, ctc and CPI receive KDDI's report. The same day, KDDI installs EDR on all servers that handle external communication. — BIGLOBE¹¹, ctc¹², CPI report¹⁰, KDDI¹
• June 23, 2026: KDDI and the six providers announce the breach. "Up to 14.22 million records" (a maximum including cancelled and dormant accounts, and hashed or encrypted passwords). — KDDI⁶, BIGLOBE²⁰, NIFTY²¹, J:COM²²
• June 26, 2026: NIFTY starts disabling, one after another, the passwords of addresses not changed by midnight at the start of June 26. — NIFTY³
• July 1, 2026: CPI asks users to change passwords and gives notice of a forced change. — CPI report¹⁰
• July 6, 2026: KDDI submits its report to MIC and publishes final figures. Each provider also publishes its figures. BIGLOBE and ctc report to the PPC and MIC the same day. — KDDI¹, BIGLOBE¹¹, ctc¹²
• July 10, 2026: CPI publishes a report for its customers. — CPI report¹⁰
• July 21, 2026: KDDI corrects the number of email addresses to 12,231,954 people. J:COM corrects its cable TV figure to 118,752 people. CPI forces a password change for Business Standard and KWC Mail users who had not changed theirs. — KDDI¹, J:COM², CPI⁴
• August 24, 2026: CPI publishes its investigation results and announces that its response is "complete." — CPI⁴

Companies that disclosed damage and what leaked

KDDI's figures are the totals KDDI published. Each provider's figures are as written in its own notice. I did not calculate a separate total.

Announced as not affected: KDDI said its own email (au mail, UQ mobile mail and au one net mail) runs on separate equipment and was not affected. — KDDI¹

As of November 4, 2026. Each company's notice may change later.