ieej-mail-2026 · Disclosed 2026-09-11
日本エネルギー経済研究所: unauthorized access and impact
Six staff Microsoft 365 accounts were compromised and file downloads confirmed. 759 email-related and 23 name-related records may have leaked; theft of 13 passport records is confirmed.
Outcome: Confirmed breach
Entry path and evidence
Timeline
Disclosure date established by the reviewed notice. [s1]
Reported response
- Reported fact
Authentication and monitoring are being strengthened and affected people notified.
[s1]続報 pp.1-2 §§1-3
Evidence relevant to prevention
Insufficient evidence
Undisclosed entry or patch timing prevents an avoidability assessment. Inspect privileges, retrieval logs, retention and deployed configuration using the linked rules.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed disclosures do not establish attacker use of AI.
Mailbox count, exposed email messages and passport-bearing messages are separate scopes. The supplied 795 figure is not a verified distinct-person count.
Sources
[s1] 日本エネルギー経済研究所 · Primary source
日本エネルギー経済研究所：事故に関する公表資料 ↗Reviewed 2026-10-09