Defense Manufacturer Phished: CUI Exposure Alert NC 2026

In early August 2026 a defense manufacturer told the Securities and Exchange Commission that one of its employees typed a Microsoft 365 password into a fake login page, and an attacker then had access to a mailbox holding purchase orders, engineering files, and, in the company's own words, potentially export-controlled technical information [1]. Nobody cracked a password and nobody exploited an unpatched server. One employee clicked one link and entered one password on a page dressed up to look like Microsoft. The company runs on roughly 30 million dollars a year [2], smaller than plenty of shops around High Point and Hickory, and if you make parts under a defense flow-down, the duty to safeguard that data and report a breach to the DoD already applies to you, prime or subcontractor, even if the SEC filing that made this one public does not.

Key takeaway: The tool that reads your engineering email is the tool that can copy your engineering email. For a defense supplier, the contents of a single inbox can carry data whose disclosure is a federal matter, not a customer-service apology.

Do you actually know which of your mailboxes hold controlled data, and whether the accounts that touch them can be phished? Contact Preferred Data Corporation at (336) 886-3282 for a CUI and email-exposure review. BBB A+ rated, serving High Point and the Piedmont Triad since 1987.

What actually happened at the defense manufacturer in August 2026?

An attacker sent a phishing email posing as a prospective business contact, with a link dressed up as a Microsoft document share; the employee entered Microsoft 365 credentials on a fraudulent page, and the attacker reached that mailbox, which the company disclosed to the SEC in a Form 8-K [1]. IEH Corporation discovered the incident on August 4, 2026, and filed the disclosure on August 6 [1]. The company reported no evidence that emails were sent from the account or that data was successfully removed, but stated that sensitive information was accessible to the unauthorized party during the compromise [1].

You have never heard of IEH Corporation, which is exactly why it belongs in front of you: it is a shop your size. It makes hi-reliability connectors used in military satellites, fighter jets, radars, and precision-guided missile programs including THAAD and Patriot [2][3]. A company that builds missile components on 30 million dollars a year sits well inside the range of the manufacturers we work with across the Piedmont Triad.

Every piece of the attack was ordinary:

• The lure impersonated a prospective customer, the one category of email an estimator is trained to open fast [1].
• The payload was a Microsoft 365 login page, not malware, so antivirus and endpoint tools had nothing to catch [1].
• The prize was a mailbox, which in a small shop is where quotes, drawings, and specs actually live, not a locked-down file server [1].

Phishing was the single most-reported cybercrime in the FBI's 2025 Internet Crime Report, with 191,561 complaints, and business email compromise drove 3.04 billion dollars in reported losses that year [5]. The IEH filing is what one of those complaints looks like when the victim happens to build missile components.

Why does an email breach hit a defense shop harder than a regular manufacturer?

Because a defense supplier's inbox can contain controlled unclassified information (CUI) and export-controlled technical data, and unauthorized access to that data carries contract and regulatory consequences a normal commercial breach does not. When a furniture maker in Lenoir loses an inbox, it is a privacy and business problem. When a defense supplier loses one, it may also be a reportable event under its Department of Defense contract and, if the drawings are export-controlled, a matter for the arms and export rules.

The entity most likely to punish a lapse is not a federal regulator. It is your prime. A prime is on the hook for the security of its own supply chain, so when it gets nervous it does the practical thing: it asks for your current SPRS score, the self-assessment score you post in the government's supplier system, before it cuts the next purchase order, or it quietly stops quoting you. A phished inbox at your shop can become a lost customer at theirs.

Two more realities stack the deck against the small subcontractor:

1. The data is in email because that is how the supply chain works. A prime sends a spec, an estimator sends a quote, an engineer sends a revised drawing. Nobody on a 40-person floor stood up a separate controlled enclave for that traffic, so the CUI lives in the same Microsoft 365 tenant as the lunch orders.
2. The obligation is already binding. DFARS clause 252.204-7012 has for years required contractors handling CUI to implement the NIST SP 800-171 security controls (110 requirements under the Rev. 2 baseline the clause references today; newer contracts may cite Rev. 3, so confirm the revision yours names) and to report cyber incidents to the DoD within 72 hours [6]. That clause did not wait for CMMC and does not depend on it.

In shops this size, the person who reads the ITAR-flagged emails and the person who administers Microsoft 365 are usually the same overworked office manager, and no one has ever drawn the map of which mailboxes hold controlled data. That missing map is why a single phished account becomes a company-wide question instead of a contained one, and it is where a Cybersecurity review for the defense industrial base starts.

CMMC Phase 2 got suspended. Does that let me off the hook?

No, and reading it that way is the most expensive mistake a defense supplier can make in 2026. On July 13, 2026, the Department of War suspended CMMC Phase 2, the milestone that would have required third-party (C3PAO) certification assessments starting November 10, and opened a 60-day review of the whole program [4]. What did not change: DFARS 252.204-7012, your NIST SP 800-171 self-assessment, your SPRS score, and your duty to protect CUI and report incidents all remain firmly in place [4][6]. The suspension paused the external audit, not the standard.

For a lot of small shops the suspension did real damage, because it handed them a reason to stop. An estimator who was finally getting phishing-resistant sign-in this fall now hears "CMMC is dead" in a trade-group email and tables the project. The IEH filing, dated three weeks after the suspension, is the counterexample delivered on schedule: the threat actor did not read the memo.

If you want a say in the replacement rules, the department's reform RFI takes comments through 12 p.m. Eastern on August 14, 2026 [7], and it is explicitly asking small suppliers what they can and cannot sustain [4]. That is worth a paragraph from your shop. It is not this week's emergency. The inbox is.

What the suspension changed, and what it did not

Ready to keep the momentum the suspension tried to take from you? Call (336) 886-3282 or learn about our Managed IT Services built for regulated small manufacturers.

What should a small NC defense manufacturer actually do this month?

Close the exact door IEH left open, in this order. The breach was an identity failure, not a firewall failure, so the highest-value fixes are cheap and fast, and most can be in place inside a week.

Two of these you can gut-check yourself in five minutes: open your Microsoft 365 admin center and see whether the old sign-in methods, called legacy authentication, are still switched on; then try to name the four or five mailboxes where drawings, quotes, and specs actually land. If you cannot do either, you have found your first two problems.

1. Turn on phishing-resistant sign-in for every account that touches CUI. A fake login page cannot replay a hardware security key or a passkey the way it replays a password and a text-message code. This maps directly to the Identification and Authentication controls in NIST SP 800-171 [6].
2. Map which mailboxes and users handle controlled data. If you cannot name where the drawings land, you cannot fence them off, and most shops your size cannot name them. This is the CUI inventory DFARS 7012 already assumes you did.
3. Shut off the old sign-in methods and require logins to come from known devices. Legacy protocols that skip modern authentication are how account takeover survives an MFA rollout. If that sentence is not yours to action, it is the first thing to hand your IT provider.
4. Write and rehearse the 72-hour incident report. DFARS 7012 requires reporting to the DoD within 72 hours of discovery [6]. IEH secured the account, disabled malicious inbox rules, and preserved evidence [1]; decide now who does each of those, at 6 p.m. on a Friday, before you need to.
5. Back up Microsoft 365, and turn on mailbox audit and sign-in logging. They do two jobs your 72-hour report needs: the logs reconstruct which messages were opened and from where; an isolated backup restores the quotes and drawings if the mailbox is wiped. Lose either and the incident becomes a guess, which is what a real Data Protection posture prevents.
6. Optional, and the window is open now: if you want to shape the replacement rules, file a comment on the CMMC reform RFI by August 14 [7]. Small suppliers are exactly who the department asked.

Steps one through five are the ones that would have changed IEH's week. Do them in that order.

How does a compromised inbox become an export-control problem?

Directly, because export-controlled technical data does not have to leave the country to be "exported" under the rules; disclosing it to an unauthorized person, including a foreign attacker sitting in a mailbox, can itself be the violation. IEH described the accessible material as potentially export-controlled technical information [1], which is why its filing reads more carefully than a typical breach notice.

For a Statesville or Winston-Salem shop making parts under an ITAR or EAR flow-down, that reframes the risk. The question is not only "was data stolen," which IEH could not confirm either way [1], but "who could see it, and were they cleared to." An attacker with a foreign IP reading drawings in a compromised inbox is a harder conversation with a contracting officer than a lost laptop. Preferred Data works with manufacturers and industrial firms across the Piedmont Triad whose controlled data lives in the same email and file systems as everything else, and the recurring finding is that the controlled traffic was never separated, never mapped, and never given phishing-resistant authentication. Each of those is fixable this month.

Serving High Point, Greensboro, Charlotte, Raleigh, and the manufacturing corridor within 200 miles for 39 years, we treat a defense supplier's email as what it is: regulated infrastructure. A short, no-charge call tells you whether your controlled email is exposed and what to fix first. Get a CUI and email-exposure review. Contact Preferred Data Corporation at (336) 886-3282.

Questions NC defense shops are asking this week

Is CMMC still required now that Phase 2 is suspended?

The third-party certification (Phase 2 / C3PAO) is paused pending a 60-day review announced July 13, 2026, but your underlying obligations are not [4]. DFARS 252.204-7012, NIST SP 800-171 self-assessment, your SPRS score, and CUI incident reporting all remain in effect [4][6]. Treat the suspension as a pause on the audit, not the standard.

What data did the defense manufacturer actually lose in the August 2026 breach?

Per the company's SEC filing, the attacker could access mailbox contents including email, attachments, customer communications, purchase orders, engineering documentation, and potentially export-controlled technical information [1]. The company reported no evidence that data was exfiltrated or that emails were sent from the account, but confirmed the information was accessible during the compromise [1].

Would multi-factor authentication have stopped this attack?

Standard app-code or text-message MFA can still be defeated by a convincing fake login page that relays the code in real time. Phishing-resistant methods, hardware security keys and passkeys, are designed to break that replay, which is why they belong on every account that touches CUI [6]. The IEH incident began with credentials entered on a fraudulent page [1], the exact scenario phishing-resistant sign-in is built to stop.

We are a subcontractor, not a prime. Does any of this apply to us?

Yes, and it may be your bigger risk. DFARS 252.204-7012 flows down through the supply chain, so if you handle CUI for a prime you carry the same protection and 72-hour reporting duties [6]. You have no SEC filing to make, but you still owe rapid incident reporting to your customer, and a nervous prime can pull your flow-down or demand a current SPRS score before the next order.

How fast can a small shop close the gap the breach exposed?

The core identity fixes, phishing-resistant sign-in, shutting off legacy sign-in methods, and mapping controlled mailboxes, typically deploy within a week for a few dozen users. Rehearsing the 72-hour report and standing up isolated Microsoft 365 backups take longer but are not large projects. A managed IT partner keeps that posture in place instead of treating it as a one-time cleanup.

Does the CMMC suspension change my DFARS 7012 duties at all?

No. DFARS 252.204-7012 is a separate, existing contract clause, and the July 13, 2026 suspension of CMMC Phase 2 did not touch it [4][6]. You still safeguard CUI to NIST SP 800-171 and report cyber incidents to the DoD within 72 hours of discovery [6].

Related Resources

• U.S. Defense Manufacturer IEH Hit by Phishing Attack - Security Affairs
• Department of War Suspends CMMC Phase II Requirements - WilmerHale
• Preferred Data Cybersecurity Services
• Preferred Data Managed IT Services
• Preferred Data for Manufacturers

References

1. IEH Corporation. (2026). Form 8-K, Current Report (Cybersecurity Incident). U.S. Securities and Exchange Commission. https://www.sec.gov/Archives/edgar/data/0000050292/000117494726000761/form8k-36187_iehc.htm
2. The Record. (2026). Military device manufacturer discloses cyber incident to SEC. https://therecord.media/military-device-manufacturer-discloses-cyber-incident
3. Security Affairs. (2026). U.S. Defense Manufacturer IEH Hit by Phishing Attack, Exposing Potentially Export-Controlled Data. https://securityaffairs.com/196890/cyber-crime/u-s-defense-manufacturer-ieh-hit-by-phishing-attack-exposing-potentially-export-controlled-data.html
4. WilmerHale. (2026). Pentagon Suspends CMMC Phase 2 Requirements and Launches Review of Cybersecurity Certification Program. https://www.wilmerhale.com/en/insights/client-alerts/20260720-pentagon-suspends-cmmc-phase-2-requirements-and-launches-review-of-cybersecurity-certification-program
5. FBI Internet Crime Complaint Center. (2026). 2025 Internet Crime Report. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf
6. Acquisition.gov. DFARS 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting. https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting.
7. Holland & Knight. (2026). DOW Suspends CMMC Phase II Requirements. https://www.hklaw.com/en/insights/publications/2026/07/dow-suspends-cmmc-phase-ii-requirements