# KDDI Zero-Day Exploit in Third-Party Software Exposes Up to 14.2 Million Email Accounts at Six Japanese ISPs (STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE, KDDI Web Communications)

> Threat actors exploited a zero-day vulnerability in unnamed third-party software embedded in a shared email infrastructure platform operated by Japanese telecom KDDI Corporation on behalf of six ISPs. Unauthorized access began around 2026-05-16 and was discovered 2026-06-17; KDDI has since confirmed 12,233,087 email addresses and 7,616,173 passwords (some hashed/encrypted, some reportedly stored in plaintext) were leaked, out of a worst-case exposure of up to 14.22 million current, former, and inactive customer accounts.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1235
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-kddi-shared-mail-platform-breach-tl-2026-1235.webp?v=80e682f7 (Threadlinqs threat intel: KDDI Email Breach Up to 14.2M Accounts: Detection & IOCs (TL-2026-1235) — High severity, 19 IOCs, 9 detection rules.)
- **ID:** TL-2026-1235
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 19

## Description

On 2026-06-17, KDDI Corporation detected unauthorized access to a shared email system it operates and provides to multiple internet service providers (ISPs) across Japan. Subsequent forensic investigation determined that the intrusion had actually begun as early as 2026-05-16, meaning attackers had roughly one month of undetected access to the platform before discovery. The root cause was identified as exploitation of a zero-day vulnerability in third-party software embedded in the shared mail infrastructure -- the flaw was unknown to the software vendor at the time of exploitation ('this vulnerability was not recognized by the software vendor'), and as of the most recent public reporting KDDI stated the vendor was still developing a patch.

The shared platform underpins email services for six operators: STNet, Inc.; JCOM Co., Ltd. (J:COM NET mail); Chubu Telecommunications Co., Inc. (marketed under the Commufa and Pikara brands); NIFTY Corporation (@nifty Mail); BIGLOBE Inc. (BIGLOBE Mail); and KDDI Web Communications' CPI rental-server mail service. KDDI's own primary mobile and fixed-line broadband email services run on separate infrastructure and were confirmed unaffected.

On the day of discovery, KDDI modified the system to block further unauthorized activity, identified the suspected point of intrusion, and implemented additional technical defensive measures, effectively evicting the attacker from the environment. KDDI publicly disclosed the incident on 2026-06-23, initially describing a worst-case exposure of up to 14.22 million email addresses and passwords (current, former, and inactive accounts combined) across the six affected ISPs. Passwords were reported as stored in hashed and/or encrypted form for most accounts, though follow-on reporting indicates that some passwords were stored in plaintext -- meaning the exposure includes both directly usable plaintext credentials and hashed/encrypted values of varying (undisclosed) strength.

As the investigation progressed, KDDI narrowed the confirmed-impact figures: by 2026-07-06 the company confirmed that 12,233,087 email addresses had definitively been exfiltrated, of which 7,616,173 also had associated passwords confirmed leaked. KDDI notified Japan's Personal Information Protection Commission and the Ministry of Internal Affairs and Communications in line with regulatory breach-notification obligations, and coordinated with all six affected ISPs on customer notification and mandatory/recommended password resets. Affected users were advised to change their email passwords immediately and to enable two-factor authentication where the mail service supports it.

No threat actor has been publicly attributed to the intrusion, no CVE identifier has been assigned or disclosed for the exploited third-party software flaw, and no indicators of compromise (IPs, domains, malware hashes) tied to the intrusion have been published by KDDI or any of the reporting outlets as of this writing. Reporting is consistent that attacker post-exploitation behavior details (persistence mechanism, lateral movement, exfiltration channel/protocol) were not disclosed by KDDI beyond confirming that bulk email address/password pairs were accessed and exfiltrated from the shared backend. The case is illustrative of third-party/shared-infrastructure supply-chain risk in the Japanese telecom/ISP sector: a single vulnerable software component embedded in a shared platform produced a blast radius spanning six independently branded ISP mail services and up to 14.2 million subscriber accounts, with mixed plaintext/hashed password storage compounding downstream credential-stuffing risk.

## MITRE ATT&CK

- T1594 Search Victim-Owned Websites
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1552 Unsecured Credentials
- T1212 Exploitation for Credential Access
- T1016 System Network Configuration Discovery
- T1082 System Information Discovery
- T1213 Data from Information Repositories
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1531 Account Access Removal

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Zero-Day Exploitation Attempt Against Shared Mail/Webmail Backend Component** (`TL-2026-1235-SPL-001`)

Detects exploitation-stage indicators against a public-facing mail infrastructure component consistent with the KDDI shared ISP mail platform breach: an inbound request to a mail-service listener followed immediately by unexpected child-process spawn from the mail service worker (indicative of successful exploit-triggered code execution against an unpatched third-party component).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1588.005, T1594
- **Data sources:** proxy, iis, mail_gateway, sysmon_process_creation
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype="proxy" OR sourcetype="iis" OR sourcetype="mail_gateway" (uri_path="*/mail*" OR uri_path="*/webmail*" OR uri_path="*/imap*" OR uri_path="*/smtp*")
| eval req_time=_time
| join type=inner src_ip [ search index=endpoint sourcetype="WinEventLog:Sysmon" EventCode=1
    ParentImage="*mailapp*" OR ParentImage="*mailworker*" OR ParentImage="*imapd*" OR ParentImage="*w3wp.exe*"
    Image IN ("*\\cmd.exe", "*\\powershell.exe", "*\\bash", "*/sh", "*\\python*")
    | eval spawn_time=_time | rename host as src_ip ]
| where spawn_time >= req_time AND spawn_time <= req_time + 30
| table req_time, src_ip, uri_path, ParentImage, Image, CommandLine, spawn_time
| sort - req_time
```

### Microsoft KQL

```kql
let webHits = DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (25, 143, 443, 993, 995) or RemoteUrl has_any ("mail", "webmail", "imap", "smtp")
| project ReqTime = Timestamp, DeviceId, DeviceName, RemoteIP;
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessParentFileName has_any ("mailapp", "mailworker", "imapd", "w3wp.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "bash", "sh", "python.exe", "python3")
| join kind=inner webHits on DeviceId
| where Timestamp between (ReqTime .. ReqTime + 30s)
| project Timestamp, DeviceName, InitiatingProcessParentFileName, FileName, ProcessCommandLine, RemoteIP
| order by Timestamp desc
```

### Sigma

```yaml
title: Public-Facing Mail Service Process Spawns Shell Interpreter (Exploit Trigger)
id: 7c1b1e6a-2f4a-4d1a-9a3e-1b2c3d4e5f61
status: experimental
description: Detects a mail/webmail service worker process spawning a command or scripting interpreter shortly after an inbound web/mail request, consistent with successful exploitation of a public-facing mail infrastructure component (as in the KDDI shared ISP mail platform zero-day breach).
references:
  - https://www.bleepingcomputer.com/news/security/data-breach-exposes-up-to-142-million-email-logins-at-six-isps/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-11
tags:
  - attack.initial-access
  - attack.t1190
  - attack.resource-development
  - attack.t1588.005
  - cve.unknown.thirdparty-mail-component
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'mailapp'
      - 'mailworker'
      - 'imapd'
      - 'w3wp.exe'
  selection_child:
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\bash'
      - '\\python.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate mail-server maintenance scripts invoked by administrators through the same worker process
  - Scheduled backup or health-check scripts configured to run from the mail service account
level: high
```

**Known false positives:**

- Legitimate admin maintenance scripts invoked through the mail worker service account
- Scheduled health-check or backup jobs launching interpreters from the same parent process

**Tuning notes:** Baseline the specific mail/webmail process names and normal maintenance-script schedule for the environment before enabling in blocking mode; whitelist known deployment/build tooling (msbuild.exe, devenv.exe) if the mail platform is IIS-hosted and under active development.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Reconnaissance and System/Network Discovery on Compromised Mail Backend Host (locked: unlock with TL Creds)
- Bulk Enumeration and Read of Multi-Tenant Mail Credential Data Store (locked: unlock with TL Creds)
- Bulk Credential Data Staging and Archive Creation Prior to Egress (locked: unlock with TL Creds)
- Outbound HTTP POST From Scripting Interpreter Immediately After Mail-Store Enumeration (Exfiltration) (locked: unlock with TL Creds)
- C2 Channel Exfiltration via Application-Layer Protocol Beacon After Bulk Data Access (locked: unlock with TL Creds)
- Mass Account Password Reset / Account Access Removal Following Breach Containment (locked: unlock with TL Creds)
- Web-Shell-Style Placeholder File Dropped Under Mail/Web Application Root (locked: unlock with TL Creds)
- Privilege Escalation / Defense Evasion Immediately Following Mail Component Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Data breach exposes up to 14.2 million email logins at six ISPs](https://www.bleepingcomputer.com/news/security/data-breach-exposes-up-to-142-million-email-logins-at-six-isps/)
- [Japanese telecom giant KDDI says data breach affects 12 million people](https://www.bleepingcomputer.com/news/security/japanese-telecom-giant-kddi-says-data-breach-affects-12-million-people/)
- [12 Million Impacted by Data Breach at Japanese Telco KDDI](https://www.securityweek.com/12-million-impacted-by-data-breach-at-japanese-telco-kddi/)
- [KDDI Data Breach Impacts up to 14.2 Million Email Accounts at Six ISPs](https://securityaffairs.com/194387/data-breach/kddi-data-breach-impacts-up-to-14-2-million-email-accounts-at-six-isps.html)
- [KDDI Confirms Zero-Day Exploit Behind Breach Affecting 12 Million People](https://securityboulevard.com/2026/07/kddi-confirms-zero-day-exploit-behind-breach-affecting-12-million-people/)
- [Information for 14 million email accounts possibly leaked in cyberattack on KDDI](https://www.japantimes.co.jp/business/2026/06/24/companies/kddi-data-breach-cyberattack/)
- [当社メールサービスに対する不正アクセスの発生について - 株式会社KDDIウェブコミュニケーションズ](https://www.kddi-webcommunications.co.jp/news/emergency/20260623a.html)
- [2026年6月23日＜報道発表資料＞KDDI株式会社 ISP事業者向けメールシステムに対する不正アクセスの発生について](https://newsroom.kddi.com/news/assets/2026/kddi_nr_s-71_4593/kddi_nr_s-71_4593_pdf_01.pdf)
- [KDDIのメールシステムに不正アクセス 最大1422万件情報漏えいの恐れ](https://atmarkit.itmedia.co.jp/ait/articles/2606/25/news036.html)
- [【セキュリティ ニュース】KDDIのISP向けメールシステム侵害](https://www.security-next.com/186287)
- [KDDI、メールシステムへの不正アクセスで1,223万件のメールアドレスが漏洩、パスワードは761万件 漏洩](https://rocket-boys.co.jp/security-measures-lab/kddi-isp-mail-unauthorized-access-leak/)
- [KDDI Data Breach Exposes 14.2 Million Logins: Shared Infrastructure Flaw Hits Six ISPs](https://www.techtimes.com/articles/319261/20260629/kddi-data-breach-exposes-142-million-logins-shared-infrastructure-flaw-hits-six-isps.htm)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1235