What KDDI confirmed
On July 6–7, 2026, KDDI reported that a mail platform used by internet service providers (ISPs) suffered unauthorized access. Confirmed figures: 12,233,087 email addresses and 7,616,173 passwords.
Incident context
The cause was exploitation of an unknown vulnerability in third-party software. At some ISPs, access began on May 16 and was detected and fixed on June 17. Affected platforms include those used by STNet, CPI, JCOM, ctc, Nifty and BIGLOBE. KDDI said au Mail, UQ mobile Mail and au one net Mail sit on separate infrastructure and were not affected.
What this is not
The platform’s outer bound of about 14.22 million accounts includes inactive users: that is not the confirmed breach count. And “12.23 million emails” is not the same as “12.23 million unique people”.
What to do
If you use mail from these ISPs, change the password, enable two-factor authentication where available and stop reusing that password elsewhere. For companies in Japan, treat ISP mail as a critical identity surface.