Key takeaways

  • Digital Arts (デジタルアーツ), a Tokyo-listed security company whose i-FILTER web filtering and m-FILTER email security products are among the most widely used in Japanese companies, government bodies and schools, said on October 21, 2026 that attackers had been inside the environment it uses to run its cloud services.
  • The attackers used stolen credentials meant for operating those services. Some of the traces date back to around July 2025, about 15 months earlier.
  • Information on some customers of six cloud services, including i-FILTER@Cloud and m-FILTER@Cloud, may have been viewed. Digital Arts has found no sign that it was taken out. It also found traces in its internal environment.
  • It found the intrusion on October 9 during an AI-assisted review of its systems, products and internal environment, prompted by the recent wave of attacks in Japan. Earlier checks had missed it.
  • All customers of the six services are asked to change administrator and user passwords. Versions of the products installed on customers' own systems are not affected.

What Digital Arts disclosed#
How it was found An AI-assisted review of systems, products and the internal environment on October 9, which found traces "that earlier checks had not found"
How long Some traces date back to around July 2025
Where The operating environment of its cloud services, and its internal environment
How Credentials used to operate the cloud services were obtained by a third party and used to get in. How they were stolen is not stated
Customer impact Information on some customers of the services below may have been viewed. No exfiltration confirmed, and no misuse reported, as of noon on October 21
Response Stolen credentials invalidated; its own operations credentials replaced; suspicious programs stopped; server authentication keys replaced. No new access seen since. It is also rebuilding its services and network
Business impact Under review

The six services:

Service What it does
i-FILTER@Cloud Cloud version of i-FILTER web filtering
m-FILTER@Cloud (Modern Edition) Cloud email security and filtering
m-FILTER MailAdviser for Microsoft 365 Email add-on for Microsoft 365
FINAL CODE@Cloud File encryption and tracking
Z-FILTER Combined secure web access (SSE) and identity (IDaaS) service
Desk Cloud service (not described in the notice)

Digital Arts asks all customers of these services to change both administrator and user passwords, and will contact some customers about further steps. Customers who run the software versions on their own servers are not affected.

What we don't know yet#

Digital Arts has not said:

  • How the operations credentials were stolen
  • What customer information sits in the affected environment: settings, user lists, logs of web or email traffic, files, or something else
  • How many customers are affected
  • What the "suspicious programs" it stopped were, and whether attackers could change how the services behaved, not only read data
  • How the intrusion into its internal environment relates to the cloud one, and whether any systems that the on-premises products connect to, such as for updates, were reachable from it. Digital Arts says the on-premises versions are not affected
  • What its AI-assisted review looked at, and why earlier checks missed what it found

Our analysis#

When the security vendor is the way in#

In our experience, the on-premises versions of i-FILTER and m-FILTER are among the most common security products in Japanese organizations, from companies to local governments and schools. Digital Arts last published a market share figure in 2015, when it cited an ITR survey putting i-FILTER at 48% of Japan's URL filtering market. How many organizations use the cloud versions affected here is not public, and the on-premises products are not affected. But the name alone means many Japanese security teams will be asking whether they are exposed.

Web and email filtering services sit in an unusually sensitive place. They see what customers' staff browse and what email they send and receive, and their settings describe how a customer's defenses work. An attacker inside the environment that runs them, with operations credentials, is in a position to learn a great deal about many organizations at once, and in principle to change what the filters let through. Digital Arts says it has found no sign of exfiltration or misuse, and nothing suggests anything beyond viewing. But in our view, customers should treat this as a supply chain incident in their security stack, not only as a password reset: review admin accounts and policy changes in these services over the past year, check alerting settings, and ask Digital Arts what information about their organization was in the environment.

It is the same pattern as this month's breaches at NEC's contractor, the trading platform behind Iwai Cosmo Securities and the website builder Studio: a provider's operations access becomes the attacker's access to its customers.

Fifteen months unseen#

Traces dating back to July 2025 mean that, at a company whose business is security, someone may have had valid operations credentials for well over a year without being noticed. Stolen credentials are hard to spot precisely because the logins look legitimate. In our view, the lesson for any service provider is that operations accounts need the same controls as customer-facing ones, or stronger: phishing-resistant authentication, access only from managed devices, alerts on unusual use, and regular rotation, so that a stolen credential stops working even if nobody notices it was stolen.

AI on the defenders' side#

There is a hopeful detail in this disclosure. Digital Arts found the intrusion because it ran an AI-assisted review, prompted by this autumn's attacks, and that review found what its usual checks had missed. This week, GMO Cybersecurity by Ierae reported attackers using AI pentest tools against Japanese companies. In our view, the same capability works for defenders who use it, and a review that finds an old intrusion is a success, even if the disclosure is uncomfortable. Digital Arts deserves credit for looking, and for saying so publicly. It would help other companies considerably if it explained what the review examined.

What this means for readers#

  • If you use any of the six services, change administrator and user passwords now, and check whether Digital Arts has contacted you about further steps.
  • Review the past year of admin logins, policy changes and allow-list changes in those services. Confirm alerting and logging settings have not been altered.
  • Ask Digital Arts what information about your organization was stored in the affected environment, and whether any of it could have been changed.
  • If you run a service for others, check that operations credentials are protected by MFA, used only from managed devices, monitored and rotated, and consider a fresh review of your environment with the tools now available, including AI.

Japanese terms at a glance#

Japanese Reading Meaning
運用に用いる認証情報 un'yō ni mochiiru ninshō jōhō Credentials used for operations
運用環境 un'yō kankyō Operating (production) environment
総点検 sō-tenken Full review, comprehensive inspection
痕跡 konseki Traces (of intrusion)
閲覧された可能性 etsuran sareta kanōsei May have been viewed
持ち出し mochidashi Exfiltration (taking data out)
サーバー認証鍵 sābā ninshō kagi Server authentication keys