Incident BriefingsZ-kai and Eikoh account compromise

Z-kai and Eikoh account compromise

The group reported 95 employee and contractor accounts and 13 customer accounts compromised in a connected October incident.

Last modified

Summary

  • Environment: Eikoh time management and Z-ID authentication
  • Operational impact: Eikoh retired its affected system; Z-kai completed security repairs
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 9, 2026; updated as evidence emerges.

What happened

Z-kai linked its October 14–15, 2026 account compromise to theft from Eikoh’s time-management system. [1]

Impact

  • Eikoh lost 95 employee and contractor account records containing login IDs, password hashes, names and email addresses. [1]
  • Thirteen customer passwords were changed in Z-ID. Names, Z-IDs, email addresses and some application dates may have been viewed; no payment-data leakage was confirmed. [1]
  • The 108-account total is separate from 953 automated password-reset accesses. [1]

Timeline

  1. Z-ID probe followed by Eikoh compromise

    The first probe compromised one customer account. Eikoh was accessed around 18:00, before further Z-ID attacks.

    [1]

  2. Reset attacks continue into early morning

    The connected attacks compromised another 12 customer accounts.

    [1]

  3. Group explains connected incidents

    The group notice describes both systems.

    [1]

  4. Briefing updated

    This briefing was last reviewed and updated on November 9, 2026.

Threat Group & Attack Vector

Stolen Eikoh account information supported automated exploitation of a Z-ID authentication vulnerability through password resets. [1]

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

Eikoh blocked external access and retired the system. Z-kai completed repairs and customer notifications. [1]