KDDI and ライフネット生命 disclosed unauthorised access to a shared system, with up to 22,541 KDDI customer records potentially leaked. Payment information and other data were not affected, but the incident highlights security challenges in intercompany ecosystems.
KDDI and ライフネット生命保険 announced on 30 October 2026 that unauthorised access had occurred in a shared system related to au Life Insurance. The incident came to light after ライフネット生命 detected suspicious access to its own system on 23 October, and KDDI blocked the access route from the LN system to the K system on 24 October.
Up to 22,541 customer records may have been leaked. Of these, 8,434 consisted of a combination of name, postal code, email address and member identifier, while 4,888 consisted of a combination of email address and member identifier. Basic information, such as gender and date of birth, may also have been leaked, but sensitive data, including passwords, credit card numbers and bank account information, was not included.
No secondary damage has been confirmed to date, and efforts to determine the full scope of the impact and complete reporting procedures with the authorities are continuing. Some functions of au Life Insurance are currently suspended for maintenance, with no restart date set. The affected customers will be contacted in due course, and warnings are being issued to watch out for scams involving suspicious emails, SMS messages and phone calls.