KDDI ISP Mail Platform Breach Final Report — About 12.23M Email Addresses, ~7.62M Plaintext Passwords
SUMMARY
On July 6, KDDI published its final report on an unauthorized access incident targeting an ISP-focused mail platform. The compromise affected approximately 12.23 million email addresses and about 7.62 million passwords; some passwords were stored in plaintext (unencrypted), which KDDI says exacerbated the impact. Users of multiple providers, including @nifty, BIGLOBE, and J:COM, were affected.
The cause is attributed to unauthorized access exploiting a third-party software vulnerability (zero-day).
The storage of plaintext passwords greatly magnifies the impact in the event of a leak. Passwords should normally be stored after being irreversibly hashed, and why plaintext remained is an issue for future investigation.
ISP mail addresses are often reused as login IDs for various services, so affected users are recommended to change passwords for other services where they registered using the same email address and password combination.
- #KDDI
- #ISP
- #plaintext passwords
- #data breach
Source
KDDI ニュースリリース — https://newsroom.kddi.com/news/assets/2026/kddi_nr_s-73_4619/kddi_nr_s-73_4619_pdf_01.pdfThis article summarizes the content of the source below. Refer to the original source for accuracy. Last updated: October 18, 2026
Was this article helpful?
Written & reviewed
Reviewed byYutaro SasaoFounder & CEO, MediaLeap Inc.
CEO of MediaLeap Inc. Working on both sides of web advertising and web media since 2013; founded the company in May 2025.
Review scope: cross-checking against primary sources (official and government announcements), verifying claims stay within the facts, and checking source attribution。Last reviewed:
Written by:Leak Watch editorial team (AI-assisted drafts verified against sources by the editorial team) · Reviewer profile · Request a correction