US defense and aerospace supplier IEH Corporation disclosed that a phishing attack gave an intruder access to an employee’s Microsoft 365 mailbox containing engineering documents and potentially export-controlled technical information.
In a Form 8-K filed with the SEC, the Brooklyn-based connector maker said a staffer fell for a lure that impersonated a prospective business contact and delivered a link disguised as a Microsoft sharing page. Typing credentials into that page handed the attacker the employee’s M365 login.
The intrusion surfaced on August 4 during IEH’s own review. Inside the mailbox sat emails, attachments, customer communications, purchase orders, engineering documents, and material that could fall under export-control rules. IEH maintains it saw no sign the data was copied or exfiltrated, though the account stayed open to the attacker for the duration of the compromise.
IEH has since secured the account, disabled malicious mailbox rules, and preserved evidence. The company says it is reviewing account security controls and authentication protections for M365, and does not expect a material impact on operations.
The export-controlled angle is the significant one. IEH’s hyperboloid connectors go into PATRIOT, THAAD, AMRAAM, and other defense programs, placing its technical data under ITAR and EAR rules where unauthorized transfer to a foreign party is a potential federal violation. The company reported nearly $30M in revenue for fiscal year 2026.
The presence of malicious mailbox rules suggests the intruder had time to set up persistence, likely to monitor communications or intercept future mail. There is no attribution, though defense supply chains have been a consistent target for both espionage and financially motivated actors.
