For: administrators and users at companies, schools, local governments and other organisations that use Digital Arts' cloud services (i-FILTER@Cloud, m-FILTER@Cloud (Modern Edition), m-FILTER MailAdviser for Microsoft 365, FINAL CODE@Cloud, z-FILTER and Desk). This article is based on the company's official notices and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 25, 2026Not yet known
- Data items that may have been viewed
- Number of customers or records
- How the credentials were obtained
- Scope of the access to the internal environment
- Impact on earnings
In its October 21 notice, the company says the impact on its earnings is under review and that it will announce promptly if anything needs to be disclosed. It says it will not publish how the credentials were obtained or the attack method, for security reasons (investor Q&A, October 23).
What administrators at customer organisations should do today
Check whether you use one of the affected services
The affected services are six cloud services: i-FILTER@Cloud, m-FILTER@Cloud (Modern Edition), m-FILTER MailAdviser for Microsoft 365, FINAL CODE@Cloud, z-FILTER and Desk.
According to the company, software versions installed in your own environment are not affected. For its other cloud services, no impact from this incident had been confirmed as of noon on October 21. If you bought through a reseller or partner, check the contract or the product name in the admin console to see whether you use the cloud version.
Change the administrator password
The company asks every customer of the six services to change administrator and user passwords. That includes organisations that have not been contacted individually.
If several people share an administrator account, use this change to review who gets the new password. For long, unique passwords, see choosing a password manager.
Tell users to change their passwords
For services with user passwords, tell users to change them as well. Say in your notice that they should sign in the usual way, not through an emailed link, so they can tell your notice apart from fake emails sent around the same time.
Anyone who used the same password for other services needs to change it there too (how to check whether a password has leaked).
Check whether the company has contacted you individually
The company says it will contact individually the customers that need to take further action. In its October 23 Q&A, it says it is contacting the customers whose information may have been viewed and explaining what they need to do.
Check the inbox of your contract contact and the address that receives messages from your reseller. The contact point is the customer support desk listed in the company's notice (k-support@daj.co.jp).
Do not sign in through links in emails claiming to be from Digital Arts
After a widely reported incident, fake "please change your password" emails in the company's name commonly appear (the company has not reported any such emails in this incident).
Change passwords by opening the admin console the way you normally do, from a bookmark or your internal procedure (see what is phishing?).
Whether you must report as a data controller depends on what the company tells you
The company says it has reported the incident to Japan's Personal Information Protection Commission (Q&A, October 23). If the data you hold in the service includes personal data and you are contacted individually as a customer whose information may have been viewed, check with your internal team, based on that notice, whether your organisation must report or notify the people concerned. Until you are contacted, the published information does not show whether your organisation's data is involved.
What happened (from Digital Arts' notices)
On October 21, 2026, Digital Arts Inc. published a notice titled "Notice and apology regarding unauthorized access to our company" through the Tokyo Stock Exchange's timely disclosure system and on its website. On October 23 it published a Q&A for investors and shareholders. Everything below is from the company's notices.
Around July 2025
The oldest of the traces of unauthorized access that were later found go back to around this time.October 9, 2026
A company-wide review of its systems, products and internal environment that used AI found traces of unauthorized access that earlier checks had missed, in both the cloud services' operating environment and the internal environment.After October 9
The company gave priority to cutting off the access, replacing credentials and investigating the scope. It says it announced only after these steps because publishing while countermeasures were under way could have told the attacker what it was doing and widened the damage.October 21
Announced through timely disclosure and on its website. Asked every customer of the six services to change passwords.October 23
Published a Q&A for investors and shareholders, stating among other things that the whitelist database was not altered and that it had reported to the Personal Information Protection Commission.
- Way in
- Credentials used to operate the cloud services were obtained by an outside party and used to get into the service operating environment. Traces of unauthorized access to the internal environment were also found
- Impact
- Information on some customers of the six services may have been viewed by the outside party. Data items and numbers not published
- Taking of data, secondary harm
- As of noon on October 21, no taking of customer data outside the company confirmed; no reports of misuse or secondary harm
- Not affected
- Software versions installed in customers' own environments. No impact confirmed for other cloud services as of noon on October 21 (October 23 Q&A)
- Whitelist
- The intruder had no permission or route to the systems that register, classify and distribute the whitelist database, and could not view it. Logs and configuration data show it was not altered (Q&A, October 23)
- Product features
- No intrusion through a vulnerability in the products' security features has been confirmed (Q&A, October 23)
- Company's response
- Disabled the credentials used in the access, replaced operational credentials, stopped suspicious programs and replaced server authentication keys. No new unauthorized access confirmed as of noon on October 21; monitoring continues. It is also rebuilding services and networks
- Reports
- Reporting to and cooperating with the relevant authorities; reported to the Personal Information Protection Commission. Will report and respond under ISMAP (Japan's government cloud security assessment programme) as the programme requires (Q&A, October 23)
- Service status
- Services continue, and new contracts and deployments are still accepted (Q&A, October 23)
- Contact
- Customers and partners: customer support desk, k-support@daj.co.jp
Operational credentials obtained
How they were obtained is not published (company)
↓
Cloud operating environment
Some customer data for six services may have been viewed
Internal environment
Traces of access; scope not published
Whitelist database
Not viewed or altered (company)
↓ What customers should do
Change administrator and user passwords
Every customer of the six services; software versions not affected
What is known and what is not
Based on the company's notices as of October 25, 2026 (the October 21 timely disclosure and website notice, and the October 23 investor Q&A). The status column will be updated as new information is published.
| Item | What the notices say | Status |
|---|---|---|
| Affected services | i-FILTER@Cloud, m-FILTER@Cloud (Modern Edition), m-FILTER MailAdviser for Microsoft 365, FINAL CODE@Cloud, z-FILTER, Desk | Confirmed (company) |
| Customer information | Information on some customers may have been viewed by an outside party | Possible (company) |
| Data items that may have been viewed | Not stated | Not stated |
| Number of customers or records | Not stated | Not stated |
| Taking of data outside the company | Not confirmed as of noon on October 21 | Not confirmed (company) |
| Misuse, secondary harm | No reports as of noon on October 21 | Not confirmed (company) |
| Software versions | Not covered by this incident | Not included (company) |
| Other cloud services | No impact from this incident confirmed as of noon on October 21 | Not confirmed (company) |
| Whitelist database | Not viewable by the intruder; confirmed not altered | Not included (company) |
| Way in | Operational credentials obtained and used to get in | Confirmed (company) |
| How the credentials were obtained, attack method | The company is withholding these details | Not stated |
| Access to the internal environment | Traces found; scope and impact not stated | Not stated |
| Period of access | Some traces go back to around July 2025; discovered October 9, 2026 | Company statement (some traces from around July 2025) |
| New unauthorized access | None confirmed as of noon on October 21; monitoring continues | Not confirmed (company) |
| Report to the Personal Information Protection Commission | Reported | Confirmed (company) |
| Impact on earnings | Under review | Under investigation |
'May have been viewed' is not the same as 'taken'
The company says customer information may have been seen by an outside party, but that as of noon on October 21 it had not confirmed that any was taken outside the company. Because the information may have been seen, the password change is requested whether or not anything was taken. This article keeps the two apart.
What can happen with an admin-facing service when the data items are unknown
The data items that may have been viewed have not been published. In general, customer records for business cloud services can include the customer organisation's name, contact people's names, email addresses and phone numbers, and administrator account details (the company has not said that any of these were involved).
What can happen in general
- Fake emails in the provider's name about contracts, renewals or password changes
- Convincing enquiries that seem to know the contact person's name or contract details
- If an administrator account is taken over, filtering or email settings could be changed
What you can do
- Change passwords and open the admin console the usual way
- If unsure whether a message is from the company, check with the contact point in its notice
- If the administrator account supports an extra sign-in factor, turn it on (choosing multi-factor authentication)
Also in October, unauthorized access to a provider of a business email-delivery service spread to its customer companies (the blastmail unauthorized access). The two incidents are separate and have different causes.
What operators should review
The detailed cause has not been published, so this section sticks to what the published account supports.
Inventory operational credentials the way you inventory people's accounts
The intruder used credentials for operating the cloud services. The company lists replacing operational credentials and server authentication keys among its response, and stronger credential and access management among its measures to prevent a repeat.
A first step for your own organisation is to list the accounts, API keys and SSH keys used to manage servers and cloud resources, with who uses each, from where, and when it was last replaced (the asset inventory checklist).
Keep records that can reveal access with valid credentials
Some traces go back to around July 2025, and according to the company earlier checks missed them. The company lists stronger monitoring and logging, and earlier detection, among its measures.
When valid credentials are used, the sign-in itself is logged as a success. In general, recording operational sign-ins down to when, from where and from which device, and regularly comparing them with staff work schedules and usual source addresses, is how such access gets noticed. If logs are kept only briefly, you cannot go back and work out the scope.
List the administrator details for every cloud service you subscribe to
On the customer side, when a provider says "every customer must change passwords", you need to know at once which service, which administrator account and who will change it.
For each cloud service you use, record who owns the administrator account, who the contract contact is and which address receives messages from the provider. For how to think about a provider being compromised, see also what to do when your web host is compromised.
Sources (public record)
The facts in this article come from the public sources below. Attack methods and figures that have not been published are not guessed at.
- Digital Arts Inc., "Notice and apology regarding unauthorized access to our company" (October 21, 2026, timely disclosure, in Japanese) — daj.jp (PDF)
- Digital Arts Inc., "Notice and apology regarding unauthorized access to our company" (October 21, 2026, website, in Japanese) — daj.jp
- Digital Arts Inc., "Q&A for investors and shareholders regarding the unauthorized access" (October 23, 2026, in Japanese) — daj.jp (PDF)
Update history
2026-10-25: First version, based on Digital Arts' October 21 timely disclosure and website notice and its October 23 investor Q&A. This article will be updated when the data items, numbers or other details are published.
Read next
- When a provider's breach reaches its customers: the blastmail unauthorized access
- When credentials are the way in: 2026 breaches that started with credentials
- Preparation: choosing multi-factor authentication / choosing a password manager
- Spotting fake emails: what is phishing?
- Other 2026 incidents: list of data breaches and cyberattacks