Skip to navigation

Threat reportData BreachTL-2026-1235

KDDI Zero-Day Exploit in Third-Party Software Exposes Up to 14.2 Million Email Accounts at Six Japanese ISPs (STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE, KDDI Web Communications)

highACTIVE

Threat actors exploited a zero-day vulnerability in unnamed third-party software embedded in a shared email infrastructure platform operated by Japanese telecom KDDI Corporation on behalf of six ISPs. Unauthorized access began around 2026-05-16 and was discovered 2026-06-17; KDDI has since confirmed 12,233,087 email addresses and 7,616,173 passwords (some hashed/encrypted, some reportedly stored in plaintext) were leaked, out of a worst-case exposure of up to 14.22 million current, former, and inactive customer accounts.

Key facts for KDDI shared mail platform breach

IdentifiersTL-2026-1235
Also known asKDDI ISP Email System Breach, KDDI Shared Mail Infrastructure Zero-Day
SeverityHIGH
Exploitation statusExploited in the wild
Affected productsKDDI Corporation Shared ISP email infrastructure (third-party software component, name undisclosed); STNet, Inc. STNet email service; JCOM Co., Ltd. J:COM NET mail service; Chubu Telecommunications Co., Inc. Commufa / Pikara mail services; NIFTY Corporation @nifty Mail; BIGLOBE Inc. BIGLOBE Mail; KDDI Web Communications Co., Ltd. CPI rental server mail service
MITRE ATT&CK techniquesT1016 System Network Configuration Discovery, T1041 Exfiltration Over C2 Channel, T1059 Command and Scripting Interpreter, T1068 Exploitation for Privilege Escalation, T1071 Application Layer Protocol, T1074 Data Staged, T1082 System Information Discovery, T1190 Exploit Public-Facing Application, T1211 Exploitation for Stealth, T1212 Exploitation for Credential Access, T1213 Data from Information Repositories, T1505 Server Software Component and 5 more in the attack flow
MotivationUNKNOWN
Target sectorstelecoms, internet-service-providers, consumer-services
Target regionsjapan, Asia-Pacific
Detection rules9 (1 shown free)
Sources12 cited sources

Detection coverage for KDDI shared mail platform breach

As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1235 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Zero-Day Exploitation Attempt Against Shared Mail/Webmail Backend Component

Detects exploitation-stage indicators against a public-facing mail infrastructure component consistent with the KDDI shared ISP mail platform breach: an inbound request to a mail-service listener followed immediately by unexpected child-process spawn from the mail service worker (indicative of successful exploit-triggered code execution against an unpatched third-party component).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1588.005, T1594
  • Data sources: proxy, iis, mail_gateway, sysmon_process_creation
  • Severity: critical
  • Confidence: high

Splunk SPL

index=web sourcetype="proxy" OR sourcetype="iis" OR sourcetype="mail_gateway" (uri_path="*/mail*" OR uri_path="*/webmail*" OR uri_path="*/imap*" OR uri_path="*/smtp*")
| eval req_time=_time
| join type=inner src_ip [ search index=endpoint sourcetype="WinEventLog:Sysmon" EventCode=1
    ParentImage="*mailapp*" OR ParentImage="*mailworker*" OR ParentImage="*imapd*" OR ParentImage="*w3wp.exe*"
    Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\bash", "*/sh", "*\\python*")
    | eval spawn_time=_time | rename host as src_ip ]
| where spawn_time >= req_time AND spawn_time <= req_time + 30
| table req_time, src_ip, uri_path, ParentImage, Image, CommandLine, spawn_time
| sort - req_time

Microsoft KQL

let webHits = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (25, 143, 443, 993, 995) or RemoteUrl has_any ("mail", "webmail", "imap", "smtp")
| project ReqTime = Timestamp, DeviceId, DeviceName, RemoteIP;
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessParentFileName has_any ("mailapp", "mailworker", "imapd", "w3wp.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "bash", "sh", "python.exe", "python3")
| join kind=inner webHits on DeviceId
| where Timestamp between (ReqTime .. ReqTime + 30s)
| project Timestamp, DeviceName, InitiatingProcessParentFileName, FileName, ProcessCommandLine, RemoteIP
| order by Timestamp desc

Sigma

title: Public-Facing Mail Service Process Spawns Shell Interpreter (Exploit Trigger)
id: 7c1b1e6a-2f4a-4d1a-9a3e-1b2c3d4e5f61
status: experimental
description: Detects a mail/webmail service worker process spawning a command or scripting interpreter shortly after an inbound web/mail request, consistent with successful exploitation of a public-facing mail infrastructure component (as in the KDDI shared ISP mail platform zero-day breach).
references:
  - https://www.bleepingcomputer.com/news/security/data-breach-exposes-up-to-142-million-email-logins-at-six-isps/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-11
tags:
  - attack.initial-access
  - attack.t1190
  - attack.resource-development
  - attack.t1588.005
  - cve.unknown.thirdparty-mail-component
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'mailapp'
      - 'mailworker'
      - 'imapd'
      - 'w3wp.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\bash'
      - '\\python.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate mail-server maintenance scripts invoked by administrators through the same worker process
  - Scheduled backup or health-check scripts configured to run from the mail service account
level: high

Known false positives:

  • Legitimate admin maintenance scripts invoked through the mail worker service account
  • Scheduled health-check or backup jobs launching interpreters from the same parent process

Tuning notes: Baseline the specific mail/webmail process names and normal maintenance-script schedule for the environment before enabling in blocking mode; whitelist known deployment/build tooling (msbuild.exe, devenv.exe) if the mail platform is IIS-hosted and under active development.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Reconnaissance and System/Network Discovery on Compromised Mail Backend Host · unlock with TL Creds
  • Bulk Enumeration and Read of Multi-Tenant Mail Credential Data Store · unlock with TL Creds
  • Bulk Credential Data Staging and Archive Creation Prior to Egress · unlock with TL Creds
  • Outbound HTTP POST From Scripting Interpreter Immediately After Mail-Store Enumeration (Exfiltration) · unlock with TL Creds
  • C2 Channel Exfiltration via Application-Layer Protocol Beacon After Bulk Data Access · unlock with TL Creds
  • Mass Account Password Reset / Account Access Removal Following Breach Containment · unlock with TL Creds
  • Web-Shell-Style Placeholder File Dropped Under Mail/Web Application Root · unlock with TL Creds
  • Privilege Escalation / Defense Evasion Immediately Following Mail Component Exploitation · unlock with TL Creds

Indicators of compromise for KDDI shared mail platform breach

As of 2026-07-11, Threadlinqs Intelligence tracks 19 indicators of compromise for TL-2026-1235.

19 indicators of compromise · unlock with TL Creds. Compare plans

How KDDI shared mail platform breach works

On 2026-06-17, KDDI Corporation detected unauthorized access to a shared email system it operates and provides to multiple internet service providers (ISPs) across Japan. Subsequent forensic investigation determined that the intrusion had actually begun as early as 2026-05-16, meaning attackers had roughly one month of undetected access to the platform before discovery. The root cause was identified as exploitation of a zero-day vulnerability in third-party software embedded in the shared mail infrastructure -- the flaw was unknown to the software vendor at the time of exploitation ('this vulnerability was not recognized by the software vendor'), and as of the most recent public reporting KDDI stated the vendor was still developing a patch.

The shared platform underpins email services for six operators: STNet, Inc.; JCOM Co., Ltd. (J:COM NET mail); Chubu Telecommunications Co., Inc. (marketed under the Commufa and Pikara brands); NIFTY Corporation (@nifty Mail); BIGLOBE Inc. (BIGLOBE Mail); and KDDI Web Communications' CPI rental-server mail service. KDDI's own primary mobile and fixed-line broadband email services run on separate infrastructure and were confirmed unaffected.

On the day of discovery, KDDI modified the system to block further unauthorized activity, identified the suspected point of intrusion, and implemented additional technical defensive measures, effectively evicting the attacker from the environment. KDDI publicly disclosed the incident on 2026-06-23, initially describing a worst-case exposure of up to 14.22 million email addresses and passwords (current, former, and inactive accounts combined) across the six affected ISPs. Passwords were reported as stored in hashed and/or encrypted form for most accounts, though follow-on reporting indicates that some passwords were stored in plaintext -- meaning the exposure includes both directly usable plaintext credentials and hashed/encrypted values of varying (undisclosed) strength.

As the investigation progressed, KDDI narrowed the confirmed-impact figures: by 2026-07-06 the company confirmed that 12,233,087 email addresses had definitively been exfiltrated, of which 7,616,173 also had associated passwords confirmed leaked. KDDI notified Japan's Personal Information Protection Commission and the Ministry of Internal Affairs and Communications in line with regulatory breach-notification obligations, and coordinated with all six affected ISPs on customer notification and mandatory/recommended password resets. Affected users were advised to change their email passwords immediately and to enable two-factor authentication where the mail service supports it.

No threat actor has been publicly attributed to the intrusion, no CVE identifier has been assigned or disclosed for the exploited third-party software flaw, and no indicators of compromise (IPs, domains, malware hashes) tied to the intrusion have been published by KDDI or any of the reporting outlets as of this writing. Reporting is consistent that attacker post-exploitation behavior details (persistence mechanism, lateral movement, exfiltration channel/protocol) were not disclosed by KDDI beyond confirming that bulk email address/password pairs were accessed and exfiltrated from the shared backend. The case is illustrative of third-party/shared-infrastructure supply-chain risk in the Japanese telecom/ISP sector: a single vulnerable software component embedded in a shared platform produced a blast radius spanning six independently branded ISP mail services and up to 14.2 million subscriber accounts, with mixed plaintext/hashed password storage compounding downstream credential-stuffing risk.

MITRE ATT&CK techniques by tactic:

Discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Collection

T1074 Data Staged; T1213 Data from Information Repositories

Initial Access

T1190 Exploit Public-Facing Application

Defense Evasion

T1211 Exploitation for Stealth

Credential Access

T1212 Exploitation for Credential Access; T1552 Unsecured Credentials

Persistence

T1505 Server Software Component

Impact

T1531 Account Access Removal

Resource Development

T1588 Obtain Capabilities

Reconnaissance

T1594 Search Victim-Owned Websites

Remediation for KDDI shared mail platform breach

Patches

  • Vendor patch for the exploited zero-day in the unnamed third-party software was still in development as of the most recent public reporting; no patch version identifier has been published

Immediate actions

  • Force password resets for all affected customer accounts across STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE, and KDDI Web Communications CPI mail
  • Enable two-factor authentication on affected webmail accounts where supported
  • Monitor affected accounts for credential-stuffing and password-reuse attacks on other services
  • Treat exposed email/password pairs as compromised across any service where the same credentials were reused
  • Prioritize remediation for accounts whose passwords were stored in plaintext, since those credentials are immediately and directly usable by attackers without cracking

Workarounds

  • KDDI applied compensating technical defensive measures and blocked the identified intrusion vector pending a vendor patch

Longer-term hardening

  • Complete vendor patch deployment for the exploited third-party software once available
  • Conduct comprehensive security review of all third-party software components embedded in shared multi-tenant infrastructure
  • Segment shared ISP email infrastructure to reduce single-point blast radius across multiple ISP brands
  • Migrate to stronger password hashing/storage technology as referenced in KDDI's stated plan to move to 'more secure communication technologies'; eliminate any remaining plaintext password storage
  • Implement enhanced logging/detection on shared infrastructure to reduce dwell time (current confirmed dwell time was approximately one month)

Affected and fixed versions

  • KDDI Corporation — Shared ISP email infrastructure (third-party software component, name undisclosed)
    Vulnerable versions: Unspecified version in production as of May-June 2026
    Fixed in: Patch in development, not yet released as of latest reporting
  • STNet, Inc. — STNet email service
    Vulnerable versions: N/A - shared backend
  • JCOM Co., Ltd. — J:COM NET mail service
    Vulnerable versions: N/A - shared backend
  • Chubu Telecommunications Co., Inc. — Commufa / Pikara mail services
    Vulnerable versions: N/A - shared backend
  • NIFTY Corporation — @nifty Mail
    Vulnerable versions: N/A - shared backend
  • BIGLOBE Inc. — BIGLOBE Mail
    Vulnerable versions: N/A - shared backend
  • KDDI Web Communications Co., Ltd. — CPI rental server mail service
    Vulnerable versions: N/A - shared backend

Timeline of KDDI shared mail platform breach

  • Threat actor gains unauthorized access to KDDI's shared ISP email infrastructure via a zero-day vulnerability in third-party software; access goes undetected for roughly one month.
  • KDDI detects the intrusion, blocks the attacker, identifies the suspected point of unauthorized access, and implements technical defensive measures, effectively evicting the attacker the same day.
  • KDDI internally confirms that email addresses and passwords used for the affected mail service may have been leaked externally.
  • KDDI Web Communications publishes its own incident notice confirming unauthorized access to its mail service and the CPI rental-server platform.
  • KDDI publicly discloses the breach, notifying that up to 14.22 million current, former, and inactive customer accounts across six ISPs (STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE, KDDI Web Communications) may be affected; regulators are notified.
  • The Japan Times and other outlets report on the disclosed breach and its scale, citing up to 14 million potentially affected accounts.
  • Japanese IT trade press (@IT/atmarkit) reports on the unauthorized access to KDDI's ISP email system, citing the 14.22 million worst-case figure.
  • Continued English-language media coverage characterizes the incident as a shared-infrastructure flaw impacting six ISPs.
  • Follow-on reporting (SecurityWeek, Security Boulevard, BleepingComputer) confirms the root cause as a zero-day exploit in third-party software unrecognized by the vendor at exploitation time, with a vendor patch still in development, and notes that some exposed passwords were stored in plaintext rather than hashed/encrypted.
  • KDDI confirms definitive impact numbers: 12,233,087 email addresses leaked, of which 7,616,173 also had passwords confirmed leaked, refining the initial worst-case estimate of 14.22 million.

Sources cited for KDDI shared mail platform breach

Drafted by the Threadlinqs research pipeline from 12 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats