National Institute for Environmental Studies: a staff member's Microsoft 365 email account was logged into without authorization, and the contents and addresses of about 50,000 emails may have leaked, with spoofed emails sent

1. 2021-05-20

   From this day until June 7, one email account on the cloud service Microsoft 365 used by a staff member was accessed from outside without authorization. [1] [2]

2. 2021-06-08

   It noticed the damage when it learned that suspicious emails had reached people it had exchanged messages with, inside and outside the institute. [1]

3. 2021-06-11

   It announced the case. [2]

The mailbox held about 50,000 emails, and email addresses and bodies may have been stolen. Many probably include personal information such as signatures, but the institute said no confidential information such as intellectual property was included. Fraudulent emails abusing the stolen addresses were sent through an outside server. The number sent is unknown, and about 50 reached the inside of the institute alone. [1] [2]