🟠 High | Source: The Register — Security
A US defence supplier, IEH Corp, suffered a data breach after an employee fell victim to a phishing attack that gave the attacker access to the company’s Microsoft 365 environment. The intruder was able to access engineering files and potentially export-controlled technical data, which may carry serious legal and national security implications. This incident highlights the ongoing risk of phishing as an initial access vector into cloud productivity platforms holding sensitive data.
Security Architect’s Take: Review and enforce phishing-resistant MFA (e.g. FIDO2/passkeys) across all Microsoft 365 accounts, particularly for staff handling sensitive or export-controlled data — password-based MFA alone is insufficient against modern phishing kits that proxy credentials in real time. Additionally, implement Conditional Access policies restricting M365 access to managed, compliant devices and consider Microsoft Purview sensitivity labels to limit exfiltration of controlled technical documents.
Original advisory: Attacker phished way into US defense supplier’s Microsoft 365 account