Cybersecurity Consultation Desk Report for Q3 2026

The Security Center of the Information-technology Promotion Agency, Japan (IPA) presents statistics and case studies on consultations from business organizations handled by its Cybersecurity Consultation Desk between July 1 and September 30, 2026. Previously, the Information Security Safe Consultation Desk handled consultations from both individuals and business organizations. Since April 2025, individuals have been served by that desk, while business organizations are served by the newly established Cybersecurity Consultation Desk. Readers are directed to a separate report for consultation data on individuals.

Consultation totals were 162 from July through September 2025, 224 from October through December 2025, 283 from January through March 2026, 302 from April through June 2026, and 309 from July through October 2026. The “fraudulent emails impersonating the president or others” category includes 29 cases. This quarter, 65 consultations concerned incident response, while the breakdown shown in the damage-type chart totals 56 cases.

In one case, a large volume of email was found to have been sent from an employee’s Microsoft account, raising suspicion of third-party misuse. The account had granted OAuth consent to App A, and it was considered likely that a third party had sent the email. The entry point and whether information had been leaked were still under investigation, and the person seeking advice asked about investigation points and verification methods. OAuth authentication allows access to data and actions within the scope granted to an app. Consenting to an attacker’s app may allow email, files, and other data to be stolen; email-sending permissions could be abused to send spoofed emails or spam.

If App A was not officially adopted, the report recommends investigating why consent was granted. Check the application ID, publisher, granted permissions and timestamps, and sign-in source IP addresses in Microsoft Entra ID audit and sign-in logs, and examine the relationship between the time consent was granted and the start of suspicious activity. In Microsoft 365, check Exchange Online audit logs, message traces, mailbox forwarding settings, and inbox rules. In assessing a possible information leak, consider not only evidence of sent messages but also the possibility that mailbox data, such as received email, was accessed.

For prevention, the report recommends reviewing Microsoft Entra ID application consent settings. If users can consent to apps at their discretion, consider restricting settings to verified publishers and permitted permissions, and establish an administrator consent and approval process. Users should check the app name, publisher, and requested access permissions on the consent screen. They should check with a system administrator about an unverified publisher and avoid approving the request if they cannot determine whether it is legitimate. The report also notes that OAuth consent attacks affect solutions beyond Microsoft and points to related Google Workspace materials and help resources from other vendors.