In late June 2026, KDDI disclosed that attackers had exploited a vulnerability in third-party software on a shared email platform the company operates for six Japanese internet providers. Up to 14.22 million customer email addresses and passwords may have been exposed, some stored in plaintext. The affected providers include KDDI’s own web communications service, JCOM, Nifty, BIGLOBE, and others.
The incident was reported and largely treated as a Japanese telecommunications story. But it illustrates a risk that applies far beyond Japan, to anyone who still has — or has ever had — an email address provided by their internet service provider.
What an ISP Email Account Is
When you sign up for home internet service, your provider typically offers you an email address that comes with the account: something ending in @comcast.net, @att.net, @btinternet.com, @virginmedia.com, @bigpond.com, @biglobe.ne.jp, or dozens of similar domains. Broadband providers in virtually every country offer this.
Decades ago, this was useful. Email was a basic utility, and your ISP email was how you communicated. Free web-based email like Gmail and Hotmail didn’t yet exist in the way they do now.
Today, most people have migrated to Gmail, Outlook, or another web-based provider. But many people kept their ISP email address — either actively, out of inertia, or passively, because they signed up for things with it years ago and never fully moved away.
That old ISP address is often still active. And it’s often being used in ways people have completely forgotten about.
The Master Key Problem
The most dangerous thing about your ISP email isn’t necessarily what’s in the inbox. It’s what it’s linked to.
Password reset flows depend on access to a trusted email address. When you forget a password to your cloud storage, your bank, your social media account, or your health portal, the service sends a reset link to the email address you registered with. Whoever controls that email address can reset your password and take over your account.
For millions of people, the email address they registered for those accounts — years or decades ago — is their ISP-provided one. They might not remember this. They switched to Gmail in 2010, they use Gmail for everything now, but when they set up their bank account in 2008, they gave it the @comcast.net address. That address is still the recovery option.
A breach of that ISP email account doesn’t just expose the inbox. It potentially grants the attacker the ability to reset passwords to every account linked to it. Cloud storage, banking, healthcare portals, shopping accounts, government services — anything registered with that address over the years.
This is what security practitioners call cascade risk: a single compromised account triggering a series of subsequent compromises.
Why ISP Email Accounts Are Poorly Secured
There are several compounding factors that make ISP email accounts particularly vulnerable.
Infrequent monitoring. People who have migrated to web-based email check their ISP inbox rarely, if ever. Suspicious activity — a password reset email, a login from an unexpected location — goes unnoticed for months or years.
Weak passwords. Because the account feels low-stakes, it’s often protected by an old, simple password from an era before password complexity was widely understood. That password may have been set in 2005 and never changed.
Absence of multi-factor authentication. ISP email portals are significantly behind web-based email providers in security features. Many don’t support multi-factor authentication at all. Google and Microsoft have spent years pushing MFA on their email users; many ISP portals have not.
No security monitoring. Gmail alerts you to suspicious logins, unusual access patterns, and new device sign-ins. ISP email portals rarely do. When attackers access an ISP email account, there’s often no notification mechanism to alert the user.
Shared infrastructure. The KDDI breach illustrates a structural vulnerability specific to ISP email: when a provider operates email services for multiple subsidiary ISPs on shared infrastructure, a vulnerability in that shared system affects all of them simultaneously. The same flaw that exposed KDDI customers also exposed customers of five other internet providers.
What the KDDI Breach Actually Exposed
KDDI’s disclosure described what was at risk: email addresses and passwords for up to 14.22 million current and former customers, including some passwords stored in plaintext. This is significant.
Hashed passwords offer some protection — an attacker needs to crack the hash before using the credential. Plaintext passwords offer none. If your KDDI email password was stored in plaintext and was the same password you use elsewhere, that combination could be tested against every other service you use within hours of the data being exfiltrated.
The attack was detected on June 17, 2026. KDDI notified Japanese regulators the same day and began remediation. For individual users, the disclosure was in late June. The window between the attack and user notification was a matter of days — faster than many breaches.
But the damage in that window depends on what the credentials unlock. A user who had a stale, rarely-used @biglobe.ne.jp address linked only to an old forum subscription faced minimal real-world risk. A user who had used that address as the recovery email for their banking, cloud storage, and social media accounts faced something much more serious.
How to Assess Your Own Risk
The first step is figuring out whether you have ISP email accounts, and what they’re linked to.
Find old ISP email addresses
Look at the email addresses you’ve used over the years. If you’ve moved house and changed internet providers, you may have had several ISP email addresses over time. Some ISPs continue operating old email accounts even after customers cancel service; others terminate them.
Search your current inbox for emails from your previous internet providers — welcome emails, billing notifications, service updates. These may reveal old addresses you’d forgotten.
Check what’s linked to each
For each ISP email address you identify, log in (if still active) and check what accounts are registered with it. You can also search your primary email for “recovery email”, “linked email”, or the ISP domain. When you sign up for services, confirmation emails typically go to the registered address — so the ISP inbox may contain years of account confirmations.
Update recovery addresses
Log in to your important accounts — cloud storage, banking, government portals, healthcare, anything financial — and check what email address is registered for password resets. Anywhere you find the ISP address, update it to an email account you actively use and secure.
Enable MFA on the ISP account
If your ISP email portal supports multi-factor authentication, enable it. If it doesn’t — which is common — treat the account as significantly higher-risk than your primary email, and prioritise migrating critical account registrations away from it.
Consider the deletion option
If an ISP email account is no longer useful and you’ve moved all recovery registrations away from it, closing the account reduces your attack surface. A closed account can’t be breached.
The Specific Risk for Cloud Storage
Your cloud storage account is a high-value target. It contains years of personal files: photos, documents, financial records, personal communications, health information. It’s also relatively easy to access if an attacker has control of your recovery email.
The typical attack sequence: attacker gains access to ISP email → initiates a password reset on cloud storage → receives the reset link → sets a new password → logs into the cloud account → exfiltrates or encrypts the contents.
This sequence can complete in minutes. It requires no technical sophistication beyond having the compromised credentials. It’s the reason security guidance consistently emphasises securing the email account that can reset everything else.
If your cloud storage recovery email is an ISP address with a weak password and no MFA, the security of the storage itself — the strength of its encryption, its login security — is largely irrelevant. The weakest link determines the outcome.
A Simple Audit
Most people have never audited which email address is the recovery contact for their important accounts. It takes less than an hour and significantly reduces cascade risk.
Start with the highest-value accounts: banking and investment platforms, cloud storage, email (your primary account), and any account that holds sensitive documents or personal data. For each, look for a “security”, “account”, or “privacy” settings section. Find the recovery or backup email. If it’s an ISP address you barely use, update it.
Then extend to medium-value accounts: subscription services, shopping accounts with saved cards, healthcare portals, government portals. The same principle applies.
The outcome of this audit is a meaningful reduction in your risk surface. It doesn’t require a technical background. It requires only knowing where to look and taking the time to look there.
ISP email accounts are easy to overlook precisely because they feel unimportant. The KDDI breach is a reminder that the accounts you forget about don’t forget about the information linked to them.