Provenance Record

Clean, well-structured News item with Overview / What We Know / What We Don't Know / Analysis sections. 465 words, within the News range (400-1200). Every factual sentence carries an inline attribution to a named cited source. Technical depth is appropriate for a general reader; no exploit code, indicators, or step-by-step attack mechanics are reproduced.

All four source snapshots were read from disk (decompressed .html.gz) and verified against the claims. source-0.html.gz (BleepingComputer, 'affects over 12 million people') CONFIRMS the July 6 update figures verbatim: email addresses of 12,233,087 people and passwords of 7,616,173 others; CONFIRMS the intrusion date of May 16 and the zero-day framing ('as of June 17, 2026 ... this vulnerability was not recognized by the software vendor'); CONFIRMS KDDI did not specify encryption type or plaintext percentage. source-1.html.gz (BleepingComputer, 'up to 14.2 million email logins') CONFIRMS up to 14.22 million customers worst-case, discovery June 17 with same-day blocking response, unnamed third-party software vulnerability, 'current and former customers, as well as inactive accounts,' the hashed/encrypted mitigation, and the password-reset/2FA guidance. source-2.html.gz (Security Affairs) CONFIRMS the six-ISP list verbatim (STNet, KDDI Web Communications, JCOM, Chubu Telecommunications, Nifty, BIGLOBE), the up-to-14.2-million figure, hashed/encrypted password storage, and that KDDI 'reported the breach to Japan's privacy and telecommunications regulators' (i.e. the PIPC and the Ministry of Internal Affairs and Communications named explicitly in sources 1 and 3). source-3.html.gz (Infosecurity Magazine) CONFIRMS up to 14.22 million email addresses and passwords, the six affected ISPs, the third-party-software vulnerability, notification of the Personal Information Protection Commission and the Ministry of Internal Affairs and Communications, and KDDI's 'strongly advised' password-change guidance. All four outlets are reputable security-press sources.

Headline elements all verified: up to 14.2M email logins (sources 1/2/3), six Japanese ISPs (sources 2/3, verbatim list), and a third-party-software zero-day (source 0 explicitly, 'a zero-day vulnerability in a third-party software'). Summary figures 12.23M addresses / 7.61M passwords match source 0 exactly. Note a benign cross-outlet nuance: BleepingComputer frames the ISPs as 'five other' providers (excluding KDDI Web Communications, a KDDI subsidiary), while Security Affairs and Infosecurity count six including it; the article correctly uses 'six' and attributes it to Infosecurity, and the six-name list is independently confirmed by Security Affairs. No hallucinated figures, names, dates, or quotes detected; the article contains no direct quotations requiring verbatim matching.

APPROVE. A tightly sourced breach report whose headline, summary, and lead each trace to cited sources, with every specific (14.2M / 12,233,087 / 7,616,173, June 17 discovery, May 16 intrusion, six named ISPs, zero-day third-party software) confirmed against the snapshots. No corrections needed.