Digital Arts, the Tokyo-listed Japanese security software maker behind the i-FILTER web filter and m-FILTER mail filter, says a third party obtained credentials used to run its cloud services and used them to get into the service operating environment. In its notice of 21 October 2026 (also filed in English with the Tokyo Stock Exchange), the company says an AI-assisted inspection of its systems, products and internal environment on 9 October found traces that earlier checks had missed, some going back to around July 2025. It also found traces of unauthorized access to its internal environment.
Six cloud services are in scope: i-FILTER@Cloud, m-FILTER@Cloud (Modern Edition), m-FILTER MailAdviser for Microsoft 365, FINAL CODE@Cloud, z-FILTER and Desk. Digital Arts says information on some customers of those services may have been viewed, and asks every customer of the six services to change administrator and user passwords. Software installed in customers' own environments is not affected, except options that run on FINAL CODE@Cloud (see the table below).
Several points narrow the picture. As of noon Japan time on 21 October (06:00 Cyprus time), Digital Arts had not confirmed that any customer information was taken out of the company, and it had received no reports of misuse or secondary harm. It says the intruder could not reach or view the whitelist database at the core of its filtering, and that the database was not altered. The services remain available. No CVE is involved, so there is nothing to check in CISA's Known Exploited Vulnerabilities catalog.
Technical Information
What Digital Arts has said (notice, 21 October; English TDnet disclosure, 21 October; customer FAQ, last updated 23 October; investor and shareholder Q&A, 23 October; all Japanese except the English filing):
- Way in. Authentication credentials used to operate the cloud services were "unlawfully obtained by a third party and subsequently used to gain unauthorized access to the service operational environment" (English filing). Digital Arts will not say how the credentials were obtained or describe the attack method, citing its own and its customers' security (Q&A, Q1; FAQ, Q5-4).
- Not a product flaw. The company says no intrusion through a vulnerability in its products' security functions has been confirmed (Q&A, Q15), and that the cause was not customers' own settings or operations (FAQ, Q5-1).
- What may have been seen. Registered email addresses were in a state where the third party could view them (FAQ, Q2-3). Product logs and settings information may also have been viewed (FAQ, Q2-5).
- What has not been confirmed. As of noon on 21 October, no taking of customer information outside the company had been confirmed. The FAQ adds that the company is not asserting that nothing was taken (FAQ, Q2-2). "May have been viewed" is not the same as "taken", and this post keeps the two apart.
- Whitelist database. The intruder had no permission or route to the systems that register, classify and distribute the whitelist database, and could not view the database itself. Logs and configuration data show it was not altered (Q&A, Q5). This is the company's own finding; no outside investigator's results have been published.
- Internal environment. Traces of access to Digital Arts' internal environment were also found. The company has not described their scope (Q&A, Q1).
- Reporting. Digital Arts has reported to Japan's Personal Information Protection Commission (Q&A, Q14) and says it will report and respond under ISMAP, Japan's government cloud security assessment programme, as the programme requires (Q&A, Q9). It is assessing the financial impact (English filing).
Timeline (Japan time, Cyprus time in brackets):
- Around July 2025: date of the oldest unauthorized-access traces later found.
- 9 October 2026: an AI-assisted company-wide inspection finds the traces. Digital Arts will not name the AI product used (FAQ, Q1-6).
- 9 to 21 October: the company prioritises cutting off access, replacing credentials and scoping the incident, and says publishing mid-response could have told the attacker what it was doing (Q&A, Q12).
- 21 October: timely disclosure on the Tokyo Stock Exchange (Japanese and English) and website notice, with status stated as of 12:00 (06:00).
- 23 October: investor and shareholder Q&A published. The customer FAQ (first publication date not stated) shows a last update of 23 October; items marked new or updated cover the FINAL CODE@Cloud-based options, single sign-on guidance and a log-download token reissue.
- 26 October, 07:37 Cyprus time: no newer notice on Digital Arts' IR news page.
The notices do not say the access was continuous since July 2025, only that some traces go back that far. Digital Arts has not published how many customers or records are involved.
Affected Product Versions
This is not a software vulnerability, so there are no affected or fixed version numbers. Scope is by service (FAQ, Q1-3, Q1-7, Q1-9, Q1-10, Q2-7, Q2-13; investor Q&A, Q4):
| Service or option | In scope? |
|---|---|
| i-FILTER@Cloud (including the GIGA edition for schools) | Yes |
| m-FILTER@Cloud (Modern Edition) | Yes |
| m-FILTER@Cloud (Classic Edition) | Only with the encryption-strengthening option |
| m-FILTER MailAdviser for Microsoft 365 | Yes (no password to change) |
| FINAL CODE@Cloud, including its clients | Yes |
| z-FILTER | Yes |
| Desk | Yes |
| m-FILTER encryption-strengthening option; m-FILTER MailAdviser (Outlook/Becky!/Thunderbird) encryption-strengthening option; FINAL CODE (ASP); FINAL CODE Ver.5 Enterprise Edition (SaaS) | Yes, because they run on FINAL CODE@Cloud |
| Software installed in your own environment (for example i-FILTER Ver.10, on-premises m-FILTER) | No, except the FINAL CODE@Cloud-based options above |
| Other Digital Arts cloud services (for example i-FILTER Browser & Cloud, f-FILTER, a-FILTER) | No impact identified as of noon on 21 October |
Workaround and Mitigation
Digital Arts' own steps, per its notice: it revoked the credentials used in the access, replaced its operational credentials, stopped suspicious programs and replaced server authentication keys. As of noon on 21 October it had seen no new unauthorized access and is monitoring. It is also rebuilding its services and network.
What customers should do, per the customer FAQ:
- Change passwords. Change both administrator and user passwords on every in-scope service, whether or not you have been contacted individually (FAQ, Q3-2, Q3-3). m-FILTER MailAdviser for Microsoft 365 has no password to change.
- Single sign-on. If you sign in through an identity provider such as Microsoft Entra ID, the services do not hold that password and it does not need to change for this incident. Passwords set on the Digital Arts services themselves should still be changed (FAQ, Q3-5).
- Log-download tokens. Digital Arts has preventively invalidated existing log-download tokens. It found no sign they were misused. If you use log download, reissue the token and update the download tool as instructed (FAQ, Q6-2).
- Check for an individual notice. Customers who need further action receive a document describing it, sent to both the customer and its reseller (FAQ, Q2-4). Check the contract contact's inbox and ask your reseller.
- Watch for fake contact. Digital Arts warns that opportunistic calls or emails may follow, and says it never asks for passwords or credentials by phone or email (FAQ, Q4-3).
- Questions. Digital Arts' dedicated desk for customers and partners is k-support@daj.co.jp (FAQ, Q6-1).
Rescana guidance (ours, not Digital Arts'): because registered email addresses, product logs and settings may have been viewed, treat unexpected messages that reference your filtering or encryption setup with extra care. Change passwords through the admin console you normally use, not through emailed links, and where the in-scope services provide admin audit logs, review them for changes you do not recognise.
Indicators of Compromise
Digital Arts has not published indicators of compromise and is withholding details of the attack method. No national CERT advisory names this incident; JPCERT/CC's alert on the current wave of intrusions at Japanese organisations (JPCERT-AT-2026-0030) does not mention Digital Arts. No source maps the incident to MITRE ATT&CK, and we have not done so either.
Why this matters for vendor risk
A web filter, a mail filter and a file-encryption service sit in the path of an organisation's browsing, email and protected documents, and here the provider itself was entered with its own operating credentials. Third-party risk teams should find out which business units, schools or subsidiaries use these services, often bought through resellers, confirm that passwords and tokens have been rotated, and ask Digital Arts how it now manages and monitors operational credentials.
Want a fast, evidence-based view of which vendors in your supply chain run on providers like this? Book a demo.
Forward this to your TPRM owner: Digital Arts says stolen operating credentials gave a third party access to the environment that runs its cloud services. Information on some customers of six services, including i-FILTER@Cloud and m-FILTER@Cloud, may have been viewed; none confirmed taken as of 21 October. All customers should change admin and user passwords.
Sources
- Digital Arts, 「当社への不正アクセスに関するお知らせとお詫び」 ("Notice and apology regarding unauthorized access to our company"), 21 October 2026 (Japanese): https://www.daj.jp/webtopics/1354/
- Digital Arts, "Notice and Apology Regarding Unauthorized Access to Our Systems", TDnet timely disclosure, 21 October 2026 (English): https://www.daj.jp/en/ir/pdf/FY0327_3q_1.pdf
- Digital Arts, 「当社への不正アクセスに関するよくあるご質問」 (customer FAQ), last updated 23 October 2026 (Japanese): https://download.daj.co.jp/support/20261021-unauthorized-access-faq.html
- Digital Arts, 「不正アクセスに関する投資家・株主の皆様向け Q&A」 (investor and shareholder Q&A), 23 October 2026 (Japanese PDF): https://www.daj.jp/shared/php/downloadset/c/parts.php?page=dl&filename=daj2326_unauthorized-access_faq.pdf
- JPCERT/CC, JPCERT-AT-2026-0030 (context only; does not name Digital Arts): https://www.jpcert.or.jp/at/2026/at260030.html
