---
title: "Z-kai and Eikoh account compromise"
description: "Z-kai linked Eikoh account theft to attacks against its Z-ID password-reset function."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-09"
canonical_url: "https://www.ally.security/incidents/z-kai-eikoh-z-id-account-incident-2026"
markdown_url: "https://www.ally.security/incidents/z-kai-eikoh-z-id-account-incident-2026.md"
stix_url: "https://www.ally.security/incidents/z-kai-eikoh-z-id-account-incident-2026/stix.json"
---

# Z-kai and Eikoh account compromise

The group reported 95 employee and contractor accounts and 13 customer accounts compromised in a connected October incident.

Last modified Nov 9, 2026 · 1 source

## Summary

- **Environment:** Eikoh time management and Z-ID authentication
- **Operational impact:** Eikoh retired its affected system; Z-kai completed security repairs
- **Financial impact:** No incident cost disclosed

## What happened

[Z-kai](https://www.zkai.co.jp/) linked its October 14–15, 2026 account compromise to theft from [Eikoh’s](https://www.eikoh.co.jp/) time-management system. [1](#source-1)

## Impact

- Eikoh lost 95 employee and contractor account records containing login IDs, password hashes, names and email addresses. [1](#source-1)
- Thirteen customer passwords were changed in Z-ID. Names, Z-IDs, email addresses and some application dates may have been viewed; no payment-data leakage was confirmed. [1](#source-1)
- The 108-account total is separate from 953 automated password-reset accesses. [1](#source-1)

## Timeline

### October 14, 2026 — Z-ID probe followed by Eikoh compromise

The first probe compromised one customer account. Eikoh was accessed around 18:00, before further Z-ID attacks. [1](#source-1)

### October 15, 2026 — Reset attacks continue into early morning

The connected attacks compromised another 12 customer accounts. [1](#source-1)

### November 9, 2026 — Group explains connected incidents

The [group notice](https://www.zkai.co.jp/post-121568/) describes both systems. [1](#source-1)

### November 9, 2026 — Briefing updated

This briefing was last reviewed and updated on November 9, 2026.

## Threat Group & Attack Vector

Stolen Eikoh account information supported automated exploitation of a Z-ID authentication vulnerability through password resets. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

Eikoh blocked external access and retired the system. Z-kai completed repairs and customer notifications. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/z-kai-eikoh-z-id-account-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Z-kai group report on unauthorized access to Eikoh and Z-ID systems

official · Zoshinkai Holdings · Nov 9, 2026

<https://www.zkai.co.jp/post-121568/>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Disclosed At · 100% confidence · current**  
   Z-kai and Eikoh account compromise: 2026-11-09
2. **Resulted In · 100% confidence · current**  
   Z-kai and Eikoh account compromise: Thirteen Z-ID account passwords were changed without authorization. Customer names, Z-IDs, email addresses and, for some customers, application dates may have been viewed. No payment-information leakage was confirmed.
3. **Occurred At · 100% confidence · current**  
   Automated Z-ID reset activity continued into early morning: 2026-10-15
4. **Affected Organization · 100% confidence · current**  
   Z-kai and Eikoh account compromise: Eikoh
5. **Resulted In · 100% confidence · current**  
   Z-kai and Eikoh account compromise: The group reported 108 compromised account records in total: 95 employee/contractor and 13 customer accounts. It counted 953 automated Z-ID password-reset accesses; that is an attempt count, not an affected-person count.
6. **Resulted In · 100% confidence · current**  
   Z-kai and Eikoh account compromise: Eikoh blocked external access, notified affected people and retired the time-management system. Z-kai completed security repairs and individual customer notifications.
7. **Resulted In · 100% confidence · current**  
   Z-kai and Eikoh account compromise: An initial Z-ID probe compromised one customer account early on October 14. Following Eikoh’s compromise around 18:00, stolen account information was used in automated password-reset attacks against a Z-ID authentication vulnerability, compromising another 12 accounts.
8. **Affected Organization · 100% confidence · current**  
   Z-kai and Eikoh account compromise: Z-kai
9. **Resulted In · 100% confidence · current**  
   Z-kai and Eikoh account compromise: Group publishes connected-incident account
10. **Resulted In · 100% confidence · current**  
   Z-kai and Eikoh account compromise: Eikoh’s time-management compromise exposed 95 employee and contractor accounts, including login IDs, password hashes, names and registered email addresses. That system held no student or guardian personal information, according to the group.
11. **Resulted In · 100% confidence · current**  
   Z-kai and Eikoh account compromise: The Z-kai group reported linked unauthorized access to Eikoh’s time-management system and Z-kai’s shared Z-ID login system on October 14–15, 2026.
12. **Occurred At · 100% confidence · current**  
   Z-ID probing and Eikoh account compromise: 2026-10-14
13. **Resulted In · 100% confidence · current**  
   Z-kai and Eikoh account compromise: Automated Z-ID reset activity continued into early morning
14. **Resulted In · 100% confidence · current**  
   Z-kai and Eikoh account compromise: Z-ID probing and Eikoh account compromise
15. **Occurred At · 100% confidence · current**  
   Group publishes connected-incident account: 2026-11-09

</details>