[Cloud Protection] Checking Compromised Account Information

This article explains how Cloud Protection administrators can review compromised account information.

In Cloud Protection, when the email address of a connected Microsoft 365 account matches a leaked login ID, information on the severity of the compromised account and the likelihood of account misuse is provided based on the type of compromised information.
For example, you can determine whether only the account email address has been leaked or whether account information, including the password, has been leaked.

Based on this compromise status information, take measures such as changing the account password or suspending the account.

Notes

1. The contents of this article are based on product specifications as of October 2026 and are subject to change without notice.
2. Administrator privileges for Cloud Protection are required to review the actual screens or change settings.
3. For information on how to access the Cloud Protection Admin Console, refer to the following article.
   How to access the HENNGE Cloud Protection Admin Console
4. Actions for compromised accounts cannot be performed in Cloud Protection. Take the necessary actions in the Microsoft 365, Access Control, or respective service administration console.

Procedure

How to review in the Cloud Protection Admin Console

1. From the left menu of the Cloud Protection Admin Console, go to [COLLABORATION PROTECTION] - [Compromised Accounts].
2. If compromised accounts exist, you can review the Target accounts and services.
   ※ If compromised accounts exist, you can narrow down the results by specifying the domain name or email address to search for in the search window at the top of the screen, and then clicking the [Refresh] button.
   For information on compromise severity, refer to Items (Severity).

Examples of actions for compromised accounts

If an account compromise is suspected in Cloud Protection, consider and implement the following actions.

1. Review access logs and investigate the situation
   Review the Target account and investigate whether there has been unauthorized access or suspicious activity.
   1. Identify what to review
      If a cloud service name is displayed under "Compromise Name," review the access logs for the relevant service and check for suspicious access, such as the examples below.
      ※ If no cloud service name is displayed and the service cannot be identified, review the access logs for the cloud services used by the relevant user or for Access Control.
      • Connections from external or overseas IP addresses, or malicious IP addresses for which public organizations (such as JPCERT/CC) have issued alerts
      • Logins outside normal business hours or on holidays
      • A large number of failed login attempts within a short period of time (signs of brute-force attacks, etc.)
      • Connections from devices or browsers that differ from those normally used
   2. Final assessment
      Review the above factors comprehensively to determine whether unauthorized access has occurred.
      ※ The final assessment must be made by the customer based on the log status and internal operational rules.
2. Initial response in the relevant service (such as terminating sessions)
   If suspicious access is identified, review the following items in order.
   • Immediately terminate the active sessions of the Target user on the service side (force logout) and change the password.

   • If the Target service is integrated with Access Control through SSO, change the password in Access Control and confirm that strict access controls (such as device control using certificates and one-time passwords) are enabled.

     Even if clear evidence of unauthorized access is not found, we recommend terminating sessions and changing passwords as preventive measures to reduce risk.

3. Prevent secondary damage (review and change passwords)
   To prevent secondary damage to other services caused by password reuse, take appropriate actions according to the risk level.
   • If passwords are or may be reused
     Change the passwords for services that use the same or similar passwords.
   • If passwords are not reused
     If passwords are centrally managed using a password manager or similar tool and it is known that the relevant password is not reused, changing passwords for other services may be omitted.

Items (Severity)

Detected information is classified into the following four severity levels.

※ Depending on the severity level, alert emails can be sent to administrators and Target users.
By default, alert emails are sent to administrators and to compromised users (when the severity is Medium or higher).
If you need to change the settings, refer to [Cloud Protection] Editing Policies.