Was the vendor behind the flaw named?
No. KDDI and every outlet that covered the breach — Security Affairs, BleepingComputer, and SC Media included — describe the flaw only as "a vulnerability in third-party software," without naming the vendor, the product, or a CVE. Six ISPs' customers still don't know which specific tool actually failed.
Answered in
One Vendor Flaw Just Exposed 14.2 Million Logins Across Six Japanese ISPsA flaw in one unnamed vendor's software let attackers into a shared email platform, exposing up to 14.2 million accounts across six Japanese ISPs.
Read the full analysisOther questions this article answers
More development best practices questions
- How many outage reports did Claude and ChatGPT get on July 14, 2026?
- What did Anthropic's own status page say about the July 14 Claude outage?
- Did Claude have more outages after July 14?
- What did ChatGPT's status checker say was wrong?
- Is this outage pattern actually unusual for AI providers?
- What GitHub Actions vulnerability did the attacker exploit?
- How many npm packages were compromised, and how widely were they used?
- What did the malicious payload actually do?
Every answer on Crashtech is written by the editor of the article it comes from — never auto-summarised. Browse all answers or the Development Best Practices beat.