KDDI Zero-Day Exposes 12.2 Million Emails and 7.6 Million Passwords in Shared ISP Infrastructure

The breach originated in a KDDI-developed component of the email backend serving STNet, J:COM, Chubu Telecommunications, NIFTY, and BIGLOBE. Attackers exploited the flaw from at least May onward, gaining persistent access until eviction. KDDI states mobile and fixed-line services ran on separate stacks and were untouched, yet the shared platform created a single point of failure for millions of consumer accounts.

Procurement records and prior vendor disclosures show this component was rolled out under multi-ISP cost-sharing agreements with minimal independent security review. The pattern mirrors earlier Japanese telco incidents where reused middleware became persistent attack surfaces. Official notices emphasize rapid eviction and forced resets yet omit contract details on vulnerability disclosure timelines or third-party code audits.

The incident reveals systemic risk: zero-days in shared consumer email stacks enable bulk credential harvesting that feeds downstream identity theft and account takeover campaigns. Routine patch management failed because the flaw existed outside standard CVE tracking until after exploitation. Transition to modern protocols will require re-architecting the same cost-sharing model that created the exposure.

KDDI and affected ISPs have begun mandatory resets; full inspection of the codebase for additional flaws is promised but lacks a published timeline or external oversight commitment.