Digital Arts Cloud Breach: Stolen Operating Credentials Opened i-FILTER@Cloud, m-FILTER@Cloud and Four More Services, With Traces Back to July 2025

Updated 2 November 2026 (Cyprus time, UTC+2): Digital Arts' customer FAQ is now dated "last updated 30 October". Since the 23 October version we first cited, it has added a section 7 that says affected customers may have to report the incident to Japan's Personal Information Protection Commission (PPC) themselves, and asks them to return a Digital Arts confirmation form by Friday 6 November 2026. As of 29 October the company had not confirmed that any personal data was actually viewed, acquired, taken out or misused. Notices to customers who need to do more than change passwords are due to be finished by early November. The FAQ now asks every DigitalArts@Cloud customer, not only users of the six in-scope services, to change passwords as a precaution. It also sets out which m-FILTER@Cloud products are in scope. It no longer says that registered email addresses, product logs or settings were viewable, and now withholds what the viewable information was. Digital Arts' 21 October notice has not changed. We updated the summary, technical details, scope table, customer actions and sources.

Digital Arts is the Tokyo-listed Japanese security software maker behind the i-FILTER web filter and the m-FILTER mail filter. It says a third party obtained credentials used to run its cloud services and used them to get into the service operating environment. In its notice of 21 October 2026 (also filed in English with the Tokyo Stock Exchange), the company says an AI-assisted inspection of its systems, products and internal environment on 9 October found traces that earlier checks had missed. Some go back to around July 2025. The inspection also found traces of unauthorized access to its internal environment.

Six cloud services are in scope: i-FILTER@Cloud, m-FILTER@Cloud (Modern Edition), m-FILTER MailAdviser for Microsoft 365, FINAL CODE@Cloud, z-FILTER and Desk. Digital Arts says information in the environment that runs these services was in a state where a third party could view it. It asks all DigitalArts@Cloud customers to change administrator and user passwords to prevent secondary harm. Software installed in customers' own environments is not affected, except options that run on FINAL CODE@Cloud (see the table below).

Several points narrow the picture. As of noon Japan time on 29 October (05:00 Cyprus time), Digital Arts had not confirmed that any information was taken out of the company. It also says it has had no reports of misuse or secondary harm. It says the intruder could not reach or view the whitelist database at the core of its filtering, and that the database was not altered. The services remain available. No CVE is involved, so there is nothing to check in CISA's Known Exploited Vulnerabilities catalog.

Technical Information

What Digital Arts has said (notice, 21 October; English TDnet disclosure, 21 October; customer FAQ, last updated 30 October; investor and shareholder Q&A, 23 October; all in Japanese except the English filing):

• Way in. Authentication credentials used to operate the cloud services were "unlawfully obtained by a third party and subsequently used to gain unauthorized access to the service operational environment" (English filing). Digital Arts will not say how the credentials were obtained or describe the attack method. It cites security reasons (Q&A, Q1; FAQ, Q5-4).
• Not a product flaw. The company says the intrusion did not use a vulnerability in its products' security functions (Q&A, Q15; first-half results, 30 October). It attributes the cause to the theft of its own operating credentials (FAQ, Q5-1, Q5-4).
• What could be seen. Information in the cloud operating environment was in a state where a third party could view it. Digital Arts will not describe that information in detail, for security reasons, because it includes details of how the environment is built (FAQ, Q2-3, Q2-5). It says it cannot determine, customer by customer, whether information was actually viewed. Instead it treats every customer whose information was viewable as affected (FAQ, Q2-16). The 23 October FAQ said registered email addresses were viewable and that product logs and settings may have been viewed. The current FAQ no longer says this, and this version of the post follows the current FAQ.
• What has not been confirmed. As of noon on 29 October, no information had been confirmed as taken out of the company (FAQ, Q2-3). As of 29 October, no personal data had been confirmed as actually viewed or acquired by a third party, taken out or misused (FAQ, Q7-I-2, Q7-V-1). The FAQ does not claim that nothing was taken (FAQ, Q2-2). "Could be viewed" is not the same as "taken", and this post keeps the two apart.
• Whitelist database. The intruder had no permission or route to the systems that register, classify and distribute the whitelist database, and could not view the database itself. Logs and configuration data show it was not altered (Q&A, Q5; first-half results, 30 October). This is the company's own finding. No outside investigator's results have been published.
• Internal environment. Traces of access to Digital Arts' internal environment were also found. The company has not described their scope (Q&A, Q1; FAQ, Q1-1).
• Regulator reporting. Digital Arts has filed a preliminary report with the PPC (FAQ, Q7-I-4). It says the PPC instructed that a report is needed whenever personal data was viewable by a third party, even if no actual viewing is confirmed (FAQ, Q7-I-1). Customers that handle the personal data may therefore have their own reporting duty under Japan's personal information law (FAQ, Q7-I-3). Digital Arts will also report and respond under ISMAP, Japan's government cloud security assessment programme, as the programme requires (Q&A, Q9).
• Financial impact. In its first-half results of 30 October, Digital Arts says its full-year forecast is unchanged (results briefing, 30 October).

Timeline (Japan time, Cyprus time in brackets):

• Around July 2025: date of the oldest traces of unauthorized access found so far.
• 9 October 2026: an AI-assisted company-wide inspection finds the traces. Digital Arts will not name the AI product used (FAQ, Q1-6).
• 9 to 21 October: the company prioritises cutting off access, replacing credentials and scoping the incident. It says publishing during that work could have told the attacker what it was doing (Q&A, Q12).
• 21 October: timely disclosure on the Tokyo Stock Exchange (Japanese and English) and website notice, with status stated as of 12:00 (06:00).
• 23 October: investor and shareholder Q&A published.
• 29 October, 12:00 (05:00): latest status point in the FAQ. No information confirmed as taken out; no personal data confirmed as viewed, acquired or misused.
• By 30 October: customer FAQ revised (latest date shown: "last updated 30 October"). Since the 23 October version it has added section 7 on PPC reporting and more detail on scope and passwords. 30 October: first-half results published; full-year forecast unchanged.
• Early November: notices to customers needing extra action due to be completed (FAQ, Q2-4, Q4-6).
• Friday 6 November: deadline for Digital Arts' PPC confirmation form (FAQ, Q7-IV-1).
• 2 November, 07:58 Cyprus time: Digital Arts' 21 October notice and 30 October FAQ unchanged; no newer incident notice on its IR news page.

The notices do not say the access was continuous since July 2025, only that some traces go back that far. Digital Arts has not published how many customers or records are involved. It says the number of licences bought will serve only as a reference point for estimating how many people could be affected in PPC reports. That number is a cap on users, not a count of people whose data was viewed (FAQ, Q7-III-1, Q7-III-2).

Affected Product Versions

This is not a software vulnerability, so there are no affected or fixed version numbers. Scope is by service (FAQ, Q1-3, Q1-7 to Q1-10, Q2-7 to Q2-13, Q3-2; investor Q&A, Q4):

Digital Arts notes that the "N or M" serial-number rule covers several m-FILTER@Cloud products, so the serial number alone does not tell you which product you have (FAQ, Q2-13).

Workaround and Mitigation

Digital Arts' own steps, per its notice and FAQ: it revoked the credentials used in the access, replaced its operational credentials, stopped suspicious programs and replaced server authentication keys. As of noon on 21 October it had seen no new unauthorized access, and it is still monitoring. It is also rebuilding its services and network (FAQ, Q1-4, Q5-2).

What customers should do, per the customer FAQ:

• Change passwords. Every DigitalArts@Cloud customer, not only users of the six in-scope services, is asked to change both administrator and user passwords, whether or not it has been contacted individually (FAQ, Q3-2, Q3-3). m-FILTER MailAdviser for Microsoft 365 has no password to change, and z-FILTER needs only the administrator password changed. Changing user passwords does not interrupt filtering or require i-FILTER@Cloud Agent re-authentication (FAQ, Q3-7). For GIGA school deployments, students' activation keys do not need renewing, and administrators can change student portal passwords centrally (FAQ, Q3-8). Support-site login passwords are not part of this request (FAQ, Q3-6).
• Single sign-on. If you sign in through an identity provider such as Microsoft Entra ID, the services do not hold that password, so it does not need to change for this incident. Passwords set on the Digital Arts services themselves should still be changed, including old ones left over from before SSO was set up (FAQ, Q3-5).
• Log-download tokens. Digital Arts has invalidated existing log-download tokens as a precaution. It found no sign they were misused. If you use log download, reissue the token and update the download tool as instructed (FAQ, Q6-2).
• Check for an individual notice. Customers who need further action receive a document describing it, sent to both the customer and its reseller. Notices go to the contract email address on the licence application, even if you have since changed your user details or opted out of mailings (FAQ, Q2-4, Q4-5). Digital Arts expects to finish these notices by early November. If you have heard nothing by then, it says no action beyond the password change is planned for you (FAQ, Q4-6).
• PPC reporting: answer by Friday 6 November. If you received the PPC reporting email, Digital Arts offers to prepare and file the report for you. For companies this is a joint report under both names; for public bodies, Digital Arts files on their behalf under a mandate. Your part is the confirmation form, which Digital Arts asks you to return by 6 November 2026. You answer once per organisation, not once per product (FAQ, Q7-II-1 to Q7-II-3, Q7-II-7, Q7-IV-1, Q7-IV-6). The 6 November date is Digital Arts' own working deadline. It is not the legal reporting deadline, and it does not extend yours if you file yourself (FAQ, Q7-IV-1, Q7-IV-2). If you have already reported to the PPC yourself, you do not need to answer the form (FAQ, Q7-II-6). Agreeing to a joint or delegated report is optional and does not release Digital Arts from responsibility (FAQ, Q7-II-4, Q7-II-5). To file yourself, or if you cannot meet the date, contact Digital Arts' legal department at daj-legaldivision@daj.co.jp (FAQ, Q7-II-4, Q7-IV-5).
• Public bodies: notifying individuals. The PPC has told public-sector customers, including boards of education and public schools, to decide for themselves whether, how and how widely to notify staff, pupils and other individuals, under their own rules (FAQ, Q7-V-1).
• Review admin history. On i-FILTER@Cloud, m-FILTER@Cloud (Modern Edition) and z-FILTER, administrator logins and operations appear under [Search] → [Settings change history] in the unified admin console. On Desk, they appear under [Admin] → [Operation log search] in the user portal (FAQ, Q2-15).
• Watch for fake contact. Digital Arts warns that scam calls or emails may try to exploit the incident. It says it never asks for passwords or credentials by phone or email (FAQ, Q4-3).
• Questions. Digital Arts' dedicated desk for customers and partners is k-support@daj.co.jp. Questions about PPC reporting go to daj-legaldivision@daj.co.jp (FAQ, Q6-1).

Rescana guidance (ours, not Digital Arts'): information in the environment that runs these services could be viewed, and Digital Arts has not said what it was. Treat unexpected messages that refer to your filtering or encryption setup with extra care. Change passwords through the admin console you normally use, not through links in emails. Review the admin history above for changes you do not recognise. If you hold personal data in these services, tell your privacy or legal team about the 6 November form now rather than waiting for the reseller to pass it on.

Indicators of Compromise

Digital Arts has not published indicators of compromise and is withholding details of the attack method. No national CERT advisory names this incident. JPCERT/CC's alert on the current wave of intrusions at Japanese organisations (JPCERT-AT-2026-0030) does not mention Digital Arts. No source maps the incident to MITRE ATT&CK, and we have not done so either.

Why this matters for vendor risk

A web filter, a mail filter and a file-encryption service sit in the path of an organisation's browsing, email and protected documents. Here the provider itself was entered using its own operating credentials. The incident has now become a regulatory task for customers too. Some may have to report to Japan's PPC themselves, and Digital Arts' form is due on 6 November. What to do with this vendor today:

1. Find out which business units, schools or subsidiaries use DigitalArts@Cloud services. They are often bought through resellers.
2. Confirm that administrator and user passwords and log-download tokens have been rotated.
3. Check whether the contract contact or the reseller has received an individual notice or the PPC reporting email. Decide before 6 November whether Digital Arts files a joint report for you or you file yourself.
4. Ask Digital Arts how it now manages and monitors operational credentials, and whether an outside party has reviewed its findings.

Our platform validates vendor claims against live attack-surface signal and chases findings to closure under your approval. Need help working out where Digital Arts' cloud services sit in your supply chain?

Talk to an expert

Forward this to your TPRM owner: Digital Arts says stolen operating credentials gave a third party access to the environment that runs its cloud services, including i-FILTER@Cloud and m-FILTER@Cloud. As of 29 October, no personal data had been confirmed as viewed or taken. All DigitalArts@Cloud customers should change admin and user passwords. Customers asked to report to Japan's PPC should return Digital Arts' confirmation form by Friday 6 November.

Sources

• Digital Arts, 「当社への不正アクセスに関するお知らせとお詫び」 ("Notice and apology regarding unauthorized access to our company"), 21 October 2026 (Japanese): https://www.daj.jp/webtopics/1354/
• Digital Arts, "Notice and Apology Regarding Unauthorized Access to Our Systems", TDnet timely disclosure, 21 October 2026 (English): https://www.daj.jp/en/ir/pdf/FY0327_3q_1.pdf
• Digital Arts, 「当社への不正アクセスに関するよくあるご質問」 (customer FAQ, including section 7 on PPC reporting), last updated 30 October 2026 (Japanese): https://download.daj.co.jp/support/20261021-unauthorized-access-faq.html
• Digital Arts, 「不正アクセスに関する投資家・株主の皆様向け Q&A」 (investor and shareholder Q&A), 23 October 2026 (Japanese PDF): https://www.daj.jp/shared/php/downloadset/c/parts.php?page=dl&filename=daj2326_unauthorized-access_faq.pdf
• Digital Arts, first-half results (決算短信) for the fiscal year ending March 2027, 30 October 2026 (Japanese PDF): https://www.daj.jp/ir/data/daj2326_202703_2q.pdf
• Digital Arts, first-half results briefing (決算補足説明資料), 30 October 2026 (Japanese PDF): https://www.daj.jp/ir/data/daj2326_202703_2q_ref.pdf
• JPCERT/CC, JPCERT-AT-2026-0030 (context only; does not name Digital Arts): https://www.jpcert.or.jp/at/2026/at260030.html