Topic starter
06/11/2026 6:55 pm
TL;DR: Unosecur’s analysis of Suntory’s cloud breach finds files with personal data for about 100,000 people were downloaded from a Microsoft 365 environment. For practitioners, the problem is not only tenant access but the spread of identity data into collaboration storage, partner files and exported lists.
Editorial analysis by NHI Mgmt Group, based on content published by Unosecur: “Suntory's Cloud Breach and the Identity Data Sitting in Collaboration Suites”.
Key questions
Q: Why can SaaS breaches bypass network and endpoint controls?
A: SaaS breaches can bypass network and endpoint controls because the attacker operates inside the provider's identity layer rather than through malware or a blocked port.
Q: How do external accounts expand collaboration-suite exposure?
A: External accounts widen collaboration-suite exposure by creating additional trusted identities, such as guests, federated users and contractor accounts, that can inherit shared folder access, chat history and file links.
Q: How should teams govern identity data stored in collaboration suites?
A: Treat the identity estate inside collaboration suites as governed data, not loose content: apply least privilege to shared drives, groups and guest roles, classify files that contain IAM records, and review ownership for service accounts, API keys and recovery contacts stored in messages or documents.
Practitioner guidance
- Map collaboration repositories to identity-data classes Inventory which shared drives, channels and tenant folders contain employee, partner, applicant and customer identity data, then assign an owner for each dataset.
- Correlate SaaS audit and sign-in logs Use cloud audit trails, sign-in history and consent records to reconstruct who accessed files, from where, and through which identity or app grant.
- Extend reviews to external and delegated access Include guest accounts, partner identities, app grants and tokens in recertification so access to collaboration data is reviewed as a single estate.
Bottom line: The breach shows that collaboration suites can become long-lived stores for identity data, not just tools for messaging and document sharing.
What's in the full article
Unosecur's full blog post covers the operational detail this post intentionally leaves for the source:
- The full detection timeline and response sequence, including how Suntory moved from anomaly detection to preliminary regulator reporting.
- The specific file groups and personal-data categories exposed across employees, partners, applicants, suppliers and customers.
- The investigation details behind the access path, including what evidence remains unresolved and what Suntory has not yet confirmed.
- The identity monitoring and remediation workflow described for collaboration suites and SaaS environments.
👉 Read Unosecur's analysis of the Suntory cloud breach and identity data exposure →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
Collaboration suites have become identity-data repositories, not just workspaces. The Suntory exposure involved files that held names, email addresses, phone numbers and registration details, which means the tenant contained identity data well beyond ordinary documents. That creates a governance problem because lifecycle ownership of the data often sits with whoever exported it, not with the team that governs identities. Practitioners should treat exported lists and shared folders as part of the identity estate, not as peripheral storage.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should teams do first after cloud file exposure?
A: First preserve logs and state needed for investigation, including audit trails, access logs, sharing events, authentication records and file version history. Then contain the exposure by revoking affected tokens, disabling risky shares, resetting credentials and recording who had access, because cloud file incidents are usually resolved through identity and permission changes rather than endpoint cleanup.
👉 Read our full editorial: Suntory breach exposes identity data in Microsoft 365 files