Japanese telecom operator KDDI and online life insurer Lifenet Insurance said in a joint statement on October 30 that someone broke into the part of Lifenet's systems that connects to KDDI. Through that link, the attacker may have pulled 22,541 records of KDDI customer data. The breached company, Lifenet, does not own the exposed data; KDDI does. The two firms say an unidentified third party used a vulnerability in some functions of Lifenet's integration system to reach information held on KDDI's side. Lifenet detected the intrusion on October 23 and KDDI cut the connection the next day. The data includes names, postal codes, phone numbers, email addresses and member identifiers. The companies say no passwords, payment card data, bank account details or insurance contract records were involved, and no misuse of the data has been confirmed.
What Happened
Japanese outlets ITmedia, Business+IT (via Yahoo! News), Nihon Jiji Shimbun and ASCII.jp all agree on this sequence, drawn from the companies' joint statement:
- October 23: Lifenet detected unauthorized access to its system (the companies call it the "LN system"). It reported this to KDDI the same day, identified where the attacker appeared to have got in, and applied technical protections.
- October 24: KDDI blocked the access route from Lifenet's system into its own customer-data system (the "K system").
- October 30: The two companies published a joint statement, seven days after detection. Breach tracker Moreta notes that this is one day longer than the 2026 median of six days it has recorded, and two days longer than the five-day median for unauthorized-access cases.
One date is reported differently. ITmedia's article says the companies made their announcement on October 23. Every other report, including ITmedia's own timeline later in the same article, gives October 23 as the detection date and October 30 as the announcement date. The October 23 announcement date looks like an error.
The companies say the intrusion was limited to the link from Lifenet's system to KDDI's system. They say KDDI's telecom and service equipment and Lifenet's other systems were not affected. Lifenet has paused some functions of "au Life Insurance" (au no Seimei Hoken), the product sold to KDDI's au mobile customers through this link, including new applications. Business+IT reports that no restart date has been given.
The two firms say they are still working out the full scope of the breach, that measures to prevent a repeat are still being drawn up, and that they are reporting to authorities as the law requires. Business+IT names Japan's Personal Information Protection Commission as one of those authorities. Nihon Jiji Shimbun notes that the statement itself does not say which authorities were notified or when. Affected customers will be contacted individually.
What Was Taken
Every report gives the same total of 22,541 records. Nihon Jiji Shimbun reproduces the companies' breakdown, which splits the records by the combination of fields that may have been exposed:
| Data fields potentially exposed | Records |
|---|---|
| Name, postal code, phone, email, member ID | 4,524 |
| Name, postal code, phone, member ID | 226 |
| Name, postal code, email, member ID | 8,434 |
| Name, postal code, member ID | 3,662 |
| Email, member ID | 4,888 |
| Member ID only | 807 |
Added up, that is 16,846 records that include a name and postal code, 17,846 that include an email address, and 4,750 that include a phone number. The companies say gender and date of birth may also have been exposed for some customers, but they have not said how many.
Some details remain unclear:
- Records, not people: Nihon Jiji Shimbun points out that the figures count records and the companies have not said how many individual customers are affected.
- Member ID: The statement does not explain what the "member identifier" refers to.
- Different field lists: Moreta lists the exposed data as including "address" and "login ID." Other reports, and the breakdown above, list postal codes and member identifiers, not full addresses or login credentials. Readers should treat the narrower description as the accurate one until the companies say otherwise.
- Excluded data: The companies say passwords, credit card numbers, bank account details, ID documents such as driver's licences, and Lifenet's insurance contract records were not involved.
The companies use cautious wording, saying the data "may have" leaked. Business+IT is the only outlet to go further, writing that the attacker "highly likely" obtained the data.
Why It Matters
This is a case where an attacker reached a company's data through a business partner. KDDI's own network was not breached. Instead, the attacker came in through a partner's system that KDDI trusted to query its customer database. KDDI and Lifenet have been linked since 2015, when they signed capital and business partnership agreements, KDDI took a stake in Lifenet, and the two launched au Life Insurance for KDDI's mobile customers, according to Nihon Jiji Shimbun. Connections like this tend to be long-lived and given wide access, and they get less scrutiny than systems facing the public internet.
It is also the second KDDI-related incident this year. Incident Radar, which collects how breached Japanese organisations describe their entry points, quotes a separate KDDI statement from June 23, 2026. In that statement KDDI attributed an earlier intrusion to a previously unknown vulnerability in third-party software built into one of its systems, which the vendor had not been aware of as of June 17. There is no sign the two incidents are connected. Still, a second breach in one year that came in through a third-party component or partner system will draw attention to how KDDI manages outside access to its data.
The exposed data is well suited to phishing. Names with email addresses and phone numbers, combined with the knowledge that the person is an au customer interested in life insurance, make convincing scams easy to write. That is likely why both companies are warning customers about messages that pretend to come from them.
The Attack Technique
The companies have given very little technical detail. Their statement says only that a malicious third party exploited a vulnerability in some functions of Lifenet's integration system and used it to obtain customer data held on KDDI's side. They have not named the type of vulnerability, the affected software, how long the attacker had access, or who was behind it. No group has claimed responsibility, and no government security agency or vendor advisory has been published.
From what has been disclosed, the attack worked in these steps:
- The attacker found a weak function in a partner-facing application (Lifenet's system).
- They abused the trusted connection between that application and KDDI's customer-data system.
- Data came back through that connection, and the varied field combinations suggest the attacker could pull records through more than one type of request or response.
The fact that KDDI's main fix was to cut the connection, not patch its own systems, suggests its system accepted whatever the partner side requested. It probably did not check whether each request made sense for a real customer session.
What Organizations Should Do
- Treat partner connections as untrusted input. Any system that lets a partner query your customer data should check each request on its own merits: limit which fields can be returned, limit queries to the customer in the current session, and do not accept a request just because it came from a known partner.
- Limit and monitor partner access volume. A partner link that normally handles one customer at a time should never be able to return tens of thousands of records without triggering an alert. Set per-connection rate limits and watch for unusual volumes.
- Map every data flow that leaves your control. List every partner, joint service and connected system that can read your customer data, what it can see, and who is responsible for its security. Joint products like au Life Insurance often fall between two companies' security teams.
- Prepare to cut connections quickly. KDDI blocked the route within a day of being told. Make sure you can switch off any single partner connection quickly without taking down unrelated services, and practise doing so.
- Contractually require timely breach notice and access to logs. Lifenet told KDDI the same day it detected the intrusion. Your contracts should require partners to report this quickly and give you access to logs so you can work out what was taken.
- Warn customers before scammers reach them. Once contact data is exposed, tell affected customers clearly that you will never ask for passwords or PINs, and tell them which official channels you use. Both companies have done this here.
Sources: KDDI: 22,541 Customer Records Potentially Leaked via Unauthorized A... | ライフネット生命の連携システムに不正アクセス KDDIの顧客情報2万2541件漏えいの可能性 日本時事新聞 | 不正アクセスはどこから入られたのか 公式の発表の文で読む｜インシデントレーダー | KDDI顧客情報2万件超流出か ライフネット生命への不正アクセスで - Today Japan News 今日の日本ニュース | KDDI、最大2.2万件の情報漏えいの可能性。連携先ライフネット生命に不正アクセス（ビジネス＋IT） - Yahoo!ニュース | ライフネット生命、KDDI連携システムへの不正アクセスでKDDI顧客情報2万2,541件が漏えいのおそれ モレタ | 2026-10-30 KDDI CORPORATION “Regarding the possibility of leakage o... | KDDIのユーザー情報が漏えいか ライフネット生命への不正アクセスで判明 - ITmedia Mobile