KDDI(ISP事業者向けメール基盤)Data breach / unauthorized access incident
- Occurred on
- June 23, 2026
- Announced on
- June 23, 2026
- Severity
- SSSIrrecoverable cascades affecting social functions, e.g. credential leaks at a ten-million scale.
- Scale
- 12,231,954 people
- Main impact
- Unauthorized access to a shared email platform for ISP operators used by @nifty, BIGLOBE, J:COM, etc., was confirmed to have resulted in the leakage of 12,231,954 email addresses (of which passwords for 7,616,173 were leaked), affecting users across multiple ISPs and prompting notices from each ISP. The July 6 investigation report was the final report.
- Information involved
- Email addressUser / member IDPassword
- Cause / key point
- The incident was caused by unauthorized access exploiting a zero-day vulnerability in third-party software, and the storage of plaintext (unhashed/improperly protected) passwords is said to have amplified the damage.About Exploitation of vulnerabilities
- Sources
- Last updated
- October 21, 2026
Is this incident worth paying attention to?
Written & reviewed
Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.
CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.
Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:
Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction
Related incidents
Browse the database →Incidents sharing the same company, service, attack method or industry (grouped automatically from the disclosures).
Other incidents at KDDI
Incidents related to "ハッシュ"
Incidents where the damage spread through the same service or system.
- Sクリプトン（SONICWIRE・D2R）2026.10.19 announced・Affected 420,000 records
- Bリンクステーション（GETTIIS会員情報）2026.10.19 announced・Affected Unknown
- Aファンケル・アテニア（EC会員情報）2026.10.16 announced・Affected 834,947 records
- SNTTソルマーレ（コミックシーモア）2026.10.15 announced・Affected Unknown
- Aビューティガレージ（ECサイト(2026年10月)）2026.10.15 announced・Affected 775,725 accounts
- SSライドオンエクスプレス（『銀のさら・釜寅・すし上等』公式サイト・公式アプリ）2026.10.13 announced・Affected 6,500,000 records
Same attack method
- SSHelpfeel（Gyazo）2026.09.16 announced・Affected 23,620,000 records
- SSEストアー(ショップサーブ)2026.10.16 announced・Affected 23,356,000 people
- SSSアドベンチャー（スカイチケット）2026.10.10 announced・Affected 14,640,000 records
- Sムラウチドットコム2026.09.15 announced・Affected 7,710,000 records
- Sホワイトエッセンス（予約・基幹システム）2026.10.05 announced・Affected 1,050,000 accounts
- ALEAN BODY2026.09.15 announced・Affected 440,000 accounts
Attack method classification: Exploitation of vulnerabilities(Breaking in through holes in software and devices)
Read the Exploitation of vulnerabilities guide and national trends →