When to call us

Phishing sent in an employee's namePartners or colleagues ask whether an email is genuine.
A bank-account change requestInvoice or payment details were altered in a thread with a supplier or customer.
Microsoft flagged a risky sign-inSign-ins from an unexpected country or device, or repeated MFA prompts nobody requested.
Unknown inbox rulesMessages are being deleted, forwarded or archived automatically.
Password reset, but no idea what was readYou need evidence for the Personal Information Protection Commission, your head office or a partner.
A vendor or partner was breachedYou need to confirm whether your own tenant was touched.

In October 2026 Nikkei and Higashi-Nihon Mitsubishi Motor Sales both disclosed Microsoft 365 account takeovers used to send phishing to their contacts. Most cases of this kind are never made public.

What the investigation establishes

  • Entry path: phishing (including adversary-in-the-middle kits), password spraying, MFA fatigue or reuse of leaked credentials.
  • Window and sources: first unauthorised sign-in to containment, the IP addresses, countries, devices and applications used.
  • Actions taken: mail and files read, searched or downloaded; mail sent; forwarding and inbox rules created; application consents and device registrations added.
  • Lateral movement: whether other accounts, SharePoint, OneDrive or Teams were reached.
  • Exposure counts: how many messages and files may have been read and what personal data they contain. This is the basis for the APPI notification decision and for what you tell partners.

Logs expire. Entra ID sign-in logs are kept for 7 days by default and 30 days with Entra ID P1 or P2. The unified audit log is kept for 180 days or one year depending on licence. Whether preservation starts on the day you notice decides how much can be proven later.

How an engagement runs

  1. Triage (same day)Secure the affected accounts, revoke sessions, disable forwarding rules, stop further damage. We tell you how to preserve logs on the call.
  2. Preserve and collectUnified audit log, Entra sign-in logs, mailbox audit, inbox rules, application consents and device registrations, collected read-only. Original data is never altered.
  3. AnalyseSeparate attacker activity from legitimate use and rebuild the timeline. Confirmed facts and inferences are labelled as such.
  4. ReportA report in English and Japanese: executive summary, technical detail, exposure list, supporting material for APPI and partner notifications, and remediation.
  5. PreventConditional access, MFA method, legacy authentication, audit settings, and continuous monitoring through SecureWatch if you want it.

Deliverables

  • Investigation report in English, Japanese or both, with facts and inferences clearly separated.
  • Timeline of the intrusion with sources and actions.
  • Count of messages and files that may have been read, and the categories of personal data involved.
  • Supporting material for the Personal Information Protection Commission report and for customer or partner notices.
  • Prioritised remediation list.

Reports are written to be handed to counsel or an insurer. For a foreign head office we deliver the same findings in English; for Japanese regulators and partners, in Japanese.

Indicative pricing

Starting pointFrom about JPY 350,000Indicative for triage and a basic investigation of a few accounts within the log retention window. The price depends on the number of accounts, the period, which logs still exist and the report languages. Multi-tenant, long-running or litigation-support investigations are quoted individually. Scope and price are fixed before work starts.

Frequently asked questions

What does it cost?

Triage and a basic investigation start at about JPY 350,000. The price depends on the number of accounts, the period, which logs still exist and the report languages. Scope and price are fixed before work starts.

How long does it take?

Triage advice the same day, preliminary findings usually within a few business days, and the report in one to several weeks depending on log volume. The sooner logs are preserved, the more can be proven.

We reset the password and the sign-ins stopped. Do we still need an investigation?

A reset stops the access but does not tell you what was read, what was sent, or which forwarding rules and application consents are still in place. Leftover rules and consents are common. Whether you must notify the regulator also depends on what was read, which only the logs can show.

Can you work in English with our head office?

Yes. Investigations, meetings and reports are available in English and Japanese, so the parent company, counsel and the Japanese regulator can each work from the same findings in their own language.

What should we do before contacting you?

Reset the affected passwords, revoke sessions, disable forwarding rules, and do not delete anything. Do not re-image devices or change audit settings before the investigation. We walk you through the exact steps on the first call.

Do we have to notify the Personal Information Protection Commission?

That depends on the categories and number of personal records exposed. One purpose of the report is to give you those counts and the evidence behind them. The legal decision should be made with counsel.

Triage today, a report built on established facts

Tell us what you are seeing and we will tell you what to do today and what the investigation would cover.

Contact