One phished staffer gave attackers the keys to a US defense supplier's Microsoft 365

IEH Corporation disclosed on August 6 that an attacker phished a single employee on August 4 and used the harvested Microsoft 365 credentials to read the contents of that user's mailbox: emails, attachments, purchase orders, and what the company, in an SEC Form 8-K filing, described as "potentially export-controlled technical information." The Brooklyn-based defense supplier says there is "no evidence" of exfiltration. That absence in the company's own logs is not the same as absence in the world, and the underlying mechanism is the story: in a default Microsoft 365 environment, one mailbox credential is functionally a master key to the tenant.

Microsoft 365, the cloud-based email and office suite that now runs mail, calendars, files, and authentication for most US businesses, is built on the assumption that whoever holds a user's password holds that user's trust. The Register's security desk, which first read through the filing, notes that the access window's start date and length were not disclosed. What IEH has confirmed is narrower than what a working credential could have done.

That gap matters more at a defense supplier than at a coffee chain. IEH builds hyperboloid connectors used in PATRIOT, AMRAAM, THAAD, APKWS, and the MARK-48 torpedo. Procurement staff at companies like IEH exchange purchase orders, program schedules, and engineering change orders with the primes (Lockheed Martin, Raytheon, BAE Systems) and with the Defense Department itself. An attacker sitting inside one procurement inbox for days, even without a confirmed exfiltration event, can quietly collect the metadata graph that primes, programs, and prices hang from: who orders what, when, on which contract line. That is useful for an industrial-base mapper and useful for someone who wants to know where to send a follow-on phishing email that will not look like a phish.

The "no evidence of exfiltration" line deserves a precise read. The 8-K is an Item 8.01 voluntary disclosure signed by IEH's CFO, Subrata Purkayastha, and "no evidence" is the registrant's own characterization of its own M365 logs. M365 is a rich environment, but it is not omniscient: a careful attacker can read mail via legacy protocols, copy attachments through a desktop client, or simply forward material to a third-party address. Mail-flow auditing catches the last case; the other two require forensic depth that small IT teams rarely buy. The company is being honest about what its own telemetry shows. It is not, and cannot be, certifying what telemetry it could not have seen.

The shape of the incident fits a pattern, not a state campaign. IEH's filing names no attacker. The Register notes that both Russia- and China-aligned actors have targeted US defense-adjacent organizations in the past year. Neither is linked to this incident. The high-frequency reality is that phishing kits and credential markets sell the same access to anyone with a few hundred dollars and a target list, so treating every phish at a defense supplier as a state operation is a category error.

What an attacker can do with a single mailbox in 2026 is the part that travels. With read access to a procurement inbox, an attacker can quietly request a payment-routing change, and the finance team will process it because the request comes from a real, internal address. They can sit on a thread, then inject a spoofed attachment in the middle of a known conversation. They can plant a forwarding rule to an outside address and let the data trickle out beyond the audit window. They can read the email signature, mimic the writing style, and use the contact graph to map the supply chain two hops out. None of this requires cutting-edge tradecraft. All of it is what defenders in incident-response shops describe as the actual cost of mailbox-only access.

The defensive moves that change the answer are architectural, not moral. Phishing-resistant MFA (FIDO2 hardware keys, Windows Hello, or platform passkeys) makes a stolen password useless without the device. Conditional access policies can require compliant devices, block legacy authentication, and step up authentication for sensitive operations like inbox-rule changes. Admin separation should put global administrators on accounts that never read mail, so a phished finance user cannot escalate. Mail-flow audit rules should alert on auto-forwarding to external recipients. App consent should be locked down so a single click on "Allow" cannot grant OAuth tokens to a malicious publisher.

The portable question is not "did IEH's employee do something wrong." It is: if one of our staff got phished tomorrow, what is the blast radius inside our own Microsoft 365 tenant, and what would we see? For most organizations, the honest answer is that they would not see it for weeks, and that the blast radius is the whole tenant. The fix is not to trust the user to never click. The fix is to design the trust model so the click does less.