KDDI and Lifenet report possible customer-data exposure through a linked system
KDDI and Lifenet confirm unauthorized access through their linked system. Six categories total 22,541 potentially exposed records, not a verified unique-person count. Passwords, payment details and insurance-contract data are excluded by the joint notice.
- Disclosed
- Oct 30, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- KDDI customer records reachable through Lifenet’s integration; exposed fields differ by record
- KDDI · Lifenet · data breach
- In the wild
- Yes
- Unauthorized access confirmed; data theft and misuse remain unconfirmed.
What happened
The notice identifies a weakness in a Lifenet integration function; it supplies no CVE or public patch. The six counts are 4,524, 226, 8,434, 3,662, 4,888 and 807. The companies report no secondary misuse so far and exclude identity-document data, other Lifenet systems and KDDI communications infrastructure. Some au life-insurance functions, including applications, remain under maintenance.
Crime-scene timeline
Oct 23, 2026
Lifenet detects unauthorized access and alerts KDDI
Oct 24, 2026
KDDI blocks the integration access route
Oct 30, 2026
Joint notice details possible exposure and customer notifications
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- KDDI and Lifenet joint noticePrimaryFull two-page October30 notice, including six record categories, exclusions and customer guidance.