Lifenet breach may have leaked 22,541 KDDI records

What the KDDI and Lifenet breach may have exposed

Names, postal codes, phone numbers, email addresses and member IDs held by KDDI may have leaked, but passwords and credit card numbers were not part of the data. KDDI, the Japanese telecom company behind the au mobile brand, and Lifenet Insurance, an online life insurer, made the announcement jointly on October 30, 2026. They said part of the customer information in KDDI's system may have reached outside parties after someone got into a Lifenet system connected to KDDI.

The records belong to KDDI customers. Lifenet's system was the way in, and KDDI's own customer database was where the data sat. The same week, MUJI operator Ryohin Keikaku disclosed a separate leak, covered in MUJI breach update adds 1.09 million card numbers. Other Japanese cases are collected in Japan data breach list: cases by date and cause.

Six combinations of contact details, 22,541 records in total

The largest group, 8,434 records, combines a name, postal code, email address and member ID. The release splits the affected records into six combinations of data and gives a count for each one.

Data that may have leaked, by combination (from the KDDI and Lifenet release)

Data in the record	Records
Name, postal code, phone number, email address, member ID	4,524
Name, postal code, phone number, member ID	226
Name, postal code, email address, member ID	8,434
Name, postal code, member ID	3,662
Email address, member ID	4,888
Member ID only	807
Total	22,541

So what one customer may have lost depends on the row. Two of the combinations, 4,750 records in all, include a phone number, and some customers' gender and date of birth may also be in the data.

Passwords, card data and policy details are not included

The data does not include bank account details, driver's licenses or the insurance contracts Lifenet holds, the companies said. Passwords and credit card information are not in any of the six combinations either.

The 22,541 figure counts records that may have leaked. It is not a confirmed number of people whose data was taken. Both companies say the investigation is continuing and that they will report again if they learn more.

How attackers reached KDDI data through Lifenet's system

A malicious third party used a vulnerability in some functions of Lifenet's linked system to obtain part of the customer data stored on KDDI's side, according to the two companies. The release calls Lifenet's linked system the "LN system" and KDDI's customer system the "K system." A vulnerability is a weakness in software or a system that an attacker can use to get in.

The release does not say which function was weak or who was behind the attack. It also does not say how many times the data was accessed before Lifenet noticed.

Detected on October 23, access route cut the next day

Lifenet told KDDI the same day, and the companies say the intrusion stayed within the link between the two systems. The sequence in the release runs as follows.

• October 23: Lifenet detected the unauthorized access to the LN system and reported it to KDDI. It located the suspected entry point and put technical defenses in place
• October 24: KDDI cut off the access route from the LN system into the K system
• October 30: The two companies published the joint release

KDDI's telecom and service facilities and Lifenet's other systems were not affected, the companies said. They are still working out the full scope, preparing steps to stop a repeat and reporting to the relevant authorities under Japanese law.

au Life Insurance applications are on hold

Lifenet has paused new applications for the plan it sells with KDDI, and the release gives no date for restarting them. That plan, au no Seimei Hoken (au Life Insurance), runs on the LN system, so Lifenet put some of its functions, including taking applications, into maintenance.

People who only use an au phone are not affected by this pause. Existing policyholders with questions about their contracts should call Lifenet's own contact center rather than KDDI.

What affected KDDI customers should watch for

No misuse had been confirmed at the time of the release, and the two companies will contact each affected customer individually. Until those notices arrive, they ask people to be careful with suspicious emails, SMS text messages and phone calls sent to the affected addresses and numbers.

Several of the six combinations include a phone number or an email address, so a fake message could arrive as an email, a text or a call. If a message claims to be from KDDI or Lifenet, do not use the links or numbers in it. Call the company on the numbers listed in the release instead.

KDDI and Lifenet will not ask for passwords

Anyone who asks for a password or PIN by phone, text or email while claiming to be KDDI or Lifenet is not from either company. Neither company requests passwords or PINs from customers.

Some records pair a name with a phone number, so a caller may know your name. That still does not make the call genuine. Hang up as soon as a password or PIN comes up, and don't tap links in texts or emails.

Where KDDI customers can call in Japan

KDDI's customer center takes calls on 157 from au phones and 0077-7-111 from other phones, from 9:00 to 20:00 every day. It is the contact listed for this incident. Questions about insurance contracts go to Lifenet instead.

Contact points listed in the release (calls from Japan, toll-free)

Topic	Contact	Number	Hours
This incident	KDDI Customer Center	157 from au mobile phones; 0077-7-111 from other phones	9:00 to 20:00, every day
au Life Insurance and other policies	Lifenet Contact Center	0120-205-566	9:00 to 20:00, closed weekends, holidays and the New Year period

Use the numbers from the release, not ones printed in a message you received. Lifenet's line is closed on weekends, so if someone calls about your policy on a weekend, wait until a weekday and call Lifenet back yourself.

What partner companies and users can learn from the link

Japan's Information-technology Promotion Agency (IPA) ranks attacks through supply chains and contractors as the second-biggest threat to organizations, and the Consumer Affairs Agency tells people to treat company emails and texts as possible phishing. KDDI's own database was not the weak point here. The way in was a partner's system that had a live connection to it.

IPA is the government body that publishes Japan's annual list of the 10 major security threats. Its 2026 list, released on January 29, ranks ransomware damage first among threats to organizations and attacks targeting supply chains and contractors second.

Partner companies: check the security of linked systems

A company's own systems can be secure and still lose customer data through a partner's weak point, so the partner's security needs checking before and after the link goes live. Any company that shares customer data with another company's system through a live connection is in the same position KDDI was in.

Limit what a partner's system can reach to the data the shared service actually needs. If the link can only read the fields it uses, an attacker who gets into the partner gets less.

Users: block scam calls with a police-recommended app

The Consumer Affairs Agency recommends apps endorsed by the National Police Agency that block scam calls automatically. A known phone number makes it easier for scammers to call while posing as a company you deal with.

The agency issued its alert on October 29, after personal data leaked through attacks on several businesses. It lists two steps that fit this case.

• Install an app recommended by the National Police Agency that blocks scam calls automatically
• Treat texts and emails from businesses as possible phishing, skip the links, and open the company's site from a bookmark or its official app

Phishing is a scam that uses emails or text messages pretending to come from a real company to lure people to a fake site and steal IDs, passwords or card numbers. People in Japan who are unsure about a message can call the consumer hotline at 188 for advice.