KDDI data breach (2026): 12 million email users and a zero-day
In mid-2026 KDDI, one of Japan’s largest telecom operators, disclosed that attackers had used a zero-day in third-party software to reach an email platform it runs for several ISPs. KDDI describes its ISO 27001 certification as company-wide.
Short answer
Was KDDI hacked?
Yes. KDDI said attackers exploited a zero-day in third-party software behind an email platform it runs for several Japanese ISPs, getting in on 16 May 2026; it detected the intrusion on 17 June.
KDDI says 12,233,087 users’ email addresses and 7,616,173 users’ passwords were accessed. It has not said how many passwords were stored in plaintext.
Timeline at a glance
16 May 2026Attackers exploit a zero-day in third-party email-platform software. (BleepingComputer)Confirmed
Last updated October 31, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
KDDI’s security posture at the time
What KDDI publicly said about its security certifications and controls, how big it is, and how its shares moved, each tied to a source. A certificate covers a stated scope at a point in time; it is not a guarantee about every system. Reviewed 31 October 2026. Compare all 2026 breaches.
Security certifications publicly held
ISO 27001ISMS certification (ISO/IEC 27001)Scope: Company-wide since April 2009, per KDDI’s security portal.Source: KDDI security portal
Scope vs breach. The published certificate scope covers the system that was breached. KDDI describes its ISMS certification as company-wide.
Publicly known security controls and platforms
After the intrusion KDDI says it blocked the attackers, deployed endpoint detection and response (EDR) tools and forced password changes (post-incident, not in place before). (company statement; BleepingComputer — KDDI breach affects 12 million)
No reliable report of a share-price move around the disclosure was found.
KDDI incident timeline, in detail
Confirmed = acknowledged by KDDI, a regulator filing or a court. Reported = credible reporting KDDI has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Jul 2026 (access from 16 May)ConfirmedThird-party software / zero-day
Zero-day in third-party software exposes ISP email accounts
What happened. KDDI said attackers exploited a zero-day in third-party software behind an email platform it runs for several Japanese ISPs, getting in on 16 May; it detected the intrusion on 17 June.
Impact. Forced password changes for affected accounts. People or records affected: 12,233,087 users’ email addresses and 7,616,173 users’ passwords accessed, per KDDI (reported by BleepingComputer).
Earlier KDDI statements gave up to about 14.2 million accounts including inactive ones; later figures are 12.2 million email addresses.
The pattern across the record
Certified, and still breached?
KDDI publicly held ISO 27001. Stated scope: Company-wide since April 2009, per KDDI’s security portal. The published scope covers the system that was breached.
The weak link was in the software supply chain
The entry point was a dependency, token or third-party software rather than the company’s own front door. Certification scopes usually cover the company’s management system; the integrity of every package, token and developer workstation is a control that has to be checked separately.
What it means for KDDI customers of KDDI and the ISPs using its email platform — and what to do
What KDDI’s customers, partners and security teams can do now, based only on what has been disclosed.
1.Check whether you used the same component
If the incident involved a named package, token or product, check your own inventory for the same component and versions.
2.Rotate shared secrets
Rotate any credentials, tokens or keys shared with the affected company until it confirms they were not exposed.
3.Ask the supplier for its findings
Ask what was taken, whether code-signing or update channels were affected, and what you need to update.
Yes. KDDI said attackers exploited a zero-day in third-party software behind an email platform it runs for several Japanese ISPs, getting in on 16 May 2026; it detected the intrusion on 17 June.
Did KDDI have SOC 2 or ISO 27001 certification?+
KDDI publicly held ISO 27001. Stated scope: Company-wide since April 2009, per KDDI’s security portal. The published scope covers the system that was breached.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by KDDI. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout