kddi-isp-2026 · Disclosed 2026-06-23

KDDI: ISP data leakage through a third-party zero-day

A software vulnerability exploited from May 16 led to ISP data leakage. KDDI says the vendor was unaware of it when detected on June 17.

Zero-day

Outcome: Confirmed breach

Entry path and evidence

Reported fact
Exploitation began May 16; the vendor was unaware of the vulnerability at June 17 detection.
[s1]3. 発生原因および対応
Reported fact
Corrected July 21 counts are 12,231,954 email-address holders, including 7,616,173 with password leakage.
[s1]2. 情報流出の詳細（7月21日訂正）

Reported fact
KDDI reported a June 17 system fix, EDR deployment, and ISP password reset measures.
[s1]3. 対応 / 4. お願い

Exploited before disclosure

Exploitation preceded disclosure; inspect component inventory, privileges, stored information, and detection to limit impact.

Editorial assessment; not a determination of liability. [s1]

AI involvementUnknown

AI is mentioned for defensive measures, not established attacker use.

Product and CVE are undisclosed; this source does not establish a single storage format for every leaked password.