On October 20, 2026, NEC said a contractor responsible for system development and maintenance had been attacked in late September. Stolen legitimate credentials were then used from the contractor's devices to access several customer environments. NEC confirmed that files on customer servers were encrypted, making systems unavailable, and that files in shared cloud storage had leaked.
The names of the contractor and affected customers, the number of people involved and the recovery status have not been disclosed. The incident shows how a maintenance account can become a path into other organisations' systems and information.
Valid credentials used against multiple customers
NEC says the initial attack on its contractor took place in late September. Attackers used stolen legitimate credentials from the contractor's devices to enter several customer environments. NEC has not named the organisations or said how the credentials were stolen.
That distinction matters: the company confirmed unauthorised access using valid accounts, but has not said whether those accounts used multifactor authentication or whether a particular configuration weakness enabled the intrusion.
Encrypted systems and exposed shared files
Files on customer servers were encrypted, leaving various systems unavailable. NEC also confirmed the leak of files in cloud storage used to share information among NEC, its customers and the contractor. Those files contained personal information held by customers and information related to their systems.
As of the announcement, NEC had not detailed the personal information involved, its volume, the length of the outages or the recovery status of each system. It said it had contacted affected customers individually. These unknowns make it impossible to measure the overall impact or conclude that every customer of the contractor was affected.
Why maintenance accounts carry concentrated risk
A contractor may need access to several environments to fix problems or maintain systems. If an associated account or device is compromised, its existing permissions can become a route into those environments. NEC says maintenance access was misused to reach customer systems in this case.
Shared cloud storage is another scope to review: collaborative files may contain contact details, customer data or technical information. Separating folders and permissions, limiting access duration and reviewing logs can reduce the possible consequences of a compromised account.
What to check after an incident notice
NEC customers should follow the messages sent to them and ask which accounts, systems and files fall within the incident's scope. They can review sign-ins from contractor devices, permission changes, maintenance accounts and the relevant sharing spaces.
If credential exposure is confirmed or suspected, replace the secret in the service where it is used and review related access. A blanket reset without an inventory can leave forgotten access in place or create a false sense of resolution. Containment and recovery belong to the teams responsible for the affected systems.
Put clear boundaries around contractor access
Before granting maintenance access, identify its owner, specify which systems it can reach and remove permissions that are no longer needed. Individual accounts make activity easier to attribute; managed devices and limited permissions reduce available paths. Sharing spaces should be inventoried with the same care as accounts that reach production systems.
NEC says it has supplied contractor staff with NEC-managed devices and intends to strengthen contractor and personal-information management. This announced measure is not a full remediation report: investigation into the scope and consequences continues.
The connection with Soclyde
Soclyde helps people create and organise unique credentials in an encrypted vault stored on their devices. This can help a small team manage human accounts, but it does not control a contractor's devices, NEC's authorisations or the cloud storage involved in this incident.
Companies must handle supplier access in the relevant systems by reviewing permissions, devices, logs and maintenance secrets. Soclyde features cover secret management, not technical incident response.
What to remember
NEC confirmed that a compromised contractor was used as a route into multiple customer environments and that shared storage contained leaked files. The scope remains unknown. Organisations working with contractors should identify shared accounts and data, then reduce access to what is required.
For human accounts, see our small-business password policy guide and Soclyde features.
