ieej-mail-2026 · Disclosed 2026-09-11
日本エネルギー経済研究所: unauthorized access and impact
Six staff Microsoft 365 accounts were compromised and file downloads confirmed. 759 email-related and 23 name-related records may have leaked; theft of 13 passport records is confirmed.
Outcome: Confirmed breach
Entry path and evidence
Timeline
Disclosure date established by the reviewed notice. [s1]
Reported response
- Reported fact
Authentication and monitoring are being strengthened and affected people notified.
[s1]続報 pp.1-2 §§1-3
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Insufficient evidence
Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed disclosures do not establish attacker use of AI.
Mailbox count, exposed email messages and passport-bearing messages are separate scopes. The supplied 795 figure is not a verified distinct-person count.
Sources
[s1] 日本エネルギー経済研究所 · Primary source
日本エネルギー経済研究所：事故に関する公表資料 ↗Reviewed 2026-10-09