What happened
IEH Corporation is a US manufacturer that The Record describes as a military device maker. On 4 August 2026 it discovered that an outsider had gained access to an employee's Microsoft 365 mailbox. It reported the incident to the US Securities and Exchange Commission in a Form 8-K signed on 6 August 2026.
The company said it had secured the account, found and removed malicious rules in the mailbox, and opened an investigation. It said it did not expect the incident to have a material adverse effect. IEH did not respond to The Record's questions.
The email
According to the filing, the attacker posed as a prospective business contact. The email carried a link disguised as a Microsoft document-sharing link. The employee followed it and entered their Microsoft 365 credentials on a fake login page. The filing does not give the sender's address or the subject line.
The malicious rules matter. Attackers who take over a mailbox often create rules that move or delete certain incoming messages. Replies from customers, or security alerts, then never reach the real owner, and the intruder stays unnoticed for longer. The filing confirms such rules were found. It does not say what they did.
Why it worked
A manufacturer's sales and engineering staff live on messages from new contacts. A prospective customer who shares a document is the best kind of email they can get. Document-sharing notices are familiar and look alike across services. A sign-in page that appears after the click feels like a normal step.
What it cost
The filing lists what the mailbox held: email, attachments, communications with customers, purchase orders, engineering documents and potentially export-controlled technical information. IEH said no evidence currently showed that unauthorised emails were sent from the account. It also said it knew only that the information was accessible to the intruder during the compromise, which means it could not rule out that some was read.
What would have helped
Sign-in methods that check the website's real address, such as passkeys and hardware security keys, defeat fake Microsoft 365 pages, because they answer only to the genuine site. Alerts on new mailbox rules, especially rules that forward, delete or hide mail, shorten the time an intruder can stay. Sensitive engineering files are also safer in a document system with its own access controls than in a mailbox.
What a warning inside the message would have shown. Antilure's Details panel shows where a link really leads and flags a link that leads to an unrelated sign-in page. A link styled as a Microsoft share that points somewhere else is the mismatch it is built to show.
Sources
- IEH Corporation, Form 8-K, Item 8.01, US Securities and Exchange Commission, signed 6 August 2026.
- Military device manufacturer discloses cyber incident, The Record, August 2026.