Breach taxonomy
Summary
IEH Corporation discovered on August 4, 2026 that a threat actor using an alias gained unauthorized access to an employee's Microsoft 365 mailbox. Initial access came from a phishing attack in which the actor impersonated a prospective business contact and delivered a fake Microsoft document-sharing link that harvested the employee's M365 credentials. Mailbox contents accessible to the actor included customer communications, purchase orders, engineering-related documentation, and potentially export-controlled technical information, though the company found no evidence data was exfiltrated or emails sent from the account. The account was secured, malicious mailbox rules disabled, and M365 authentication controls reviewed. Filed under Item 8.01; materiality not formally determined as of the filing date, with the company stating it does not expect a material adverse effect on operations.
Tagging rationale
ThreatUnknown
Filing describes only “a threat actor using an alias” who “impersonated a prospective business contact,” with no attribution to a specific actor category → UNKNOWN.
MethodsAccount TakeoverPhishing
Filing states the actor “gained unauthorized access to the Microsoft 365 mailbox of an employee” after the user “entered Microsoft 365 credentials into a fraudulent login page” → ACCOUNT-TAKEOVER via PHISHING. DATA-EXFIL is not assigned because the filing states “No evidence currently exists that … data was successfully exfiltrated.”
AssetsIp Trade SecretsConfidential Biz
Filing states the actor gained access to mailbox contents including “engineering-related documentation, and potentially export-controlled technical information” → IP-TRADE-SECRETS, plus “customer communications, purchase orders” → CONFIDENTIAL-BIZ.
EffectsNetwork SecurityInfo Privacy Loss
Filing discloses unauthorized access to a corporate mailbox with malicious mailbox rules created → NETWORK-SECURITY; sensitive information “was accessible to the unauthorized party during the compromise period” with possible notifications to affected parties and regulators → INFO-PRIVACY-LOSS. No operational disruption or extortion disclosed.
Business continuityNot Required
Filing describes containment of a single mailbox with no systems downtime and states the incident “will not have a material adverse effect on its business operations” → no continuity procedures required.
Impact
Single employee mailbox compromised via phishing and contained on the day of discovery with no confirmed exfiltration, but accessible content included engineering documentation and potentially export-controlled technical information carrying regulatory notification exposure → score 2.
InsuranceNot disclosed
Filing makes no mention of cyber insurance or insurance coverage → null.
Read the original SEC filing excerpt
Item 8.01 Other Events On August 4, 2026, IEH Corporation (“IEH” or the “Company”) discovered that it sustained a cybersecurity incident whereby a threat actor using an alias gained unauthorized access to the Microsoft 365 mailbox of an employee of the Company. As soon as the incident was observed, the Company took action to contain the unauthorized access. An investigation determined the compromise originated from a phishing attack in which a malicious actor impersonated a prospective business contact and delivered a hyperlink disguised as a Microsoft document-sharing link. The user accessed the link and entered Microsoft 365 credentials into a fraudulent login page, resulting in unauthorized account access. The threat actor gained access to mailbox contents, including email messages, attachments, customer communications, purchase orders, engineering-related documentation, and potentially export-controlled technical information. No evidence currently exists that unauthorized emails were transmitted from the account or that data was successfully exfiltrated. However, sensitive information was accessible to the unauthorized party during the compromise period. The account was secured, malicious mailbox rules were disabled, evidence was preserved, and corrective actions are underway. Following containment and investigation activities, the Company initiated a review of account security controls and authentication protections applicable to Microsoft 365 services. The Company has already taken and completed a series of corrective actions to contain any impact of the unauthorized access. However, at this time, the Company has no evidence that information was transmitted externally, downloaded or infiltrated. The Company only knows that the information was accessible to the unauthorized actor during the compromise period. The Company is continuing to review the impacted communications and will provide, if necessary, any required notifications to affected parties and applicable regulatory agencies. As of the date of this filing on Form 8-K, the Company believes that the incident will not have a material adverse effect on its business operations. The Company is continuing to investigate the incident.