Nikkei discloses third breach in a month as 1.8 million records are exposed

Japanese business news and financial information group Nikkei Inc., the owner of the Financial Times, has disclosed a new data breach exposing about 1.83 million personal information records, according to BleepingComputer. It is the third security incident the company has revealed in roughly a month, raising questions about how attackers keep gaining access through compromised accounts.

What happened

According to BleepingComputer, hackers used stolen credentials to log in to a Nikkei development system on the morning of October 7. That unauthorized access exposed personal information stored in the cloud. Nikkei said it revoked the abused credentials and notified Japan's Personal Information Protection Commission on October 11.

The company said it is "working urgently to establish the extent of the damage" and is still determining the cause. As of October 16, Nikkei said, it had found no evidence that the accessed data had been misused or leaked online, and no signs of broader system compromise, data tampering or service outages. BleepingComputer said it had asked Nikkei for further details.

What data was exposed

Of the roughly 1.83 million records, about 150,000 contained at least one of the following: full names, email addresses, physical addresses, telephone numbers or dates of birth, BleepingComputer reported. Email addresses were present in about 120,000 of those records. The remaining 1.68 million records did not contain identifying information, according to the company. Nikkei said no credit card information was exposed, and that affected individuals will be notified individually.

A pattern of account compromises

The new disclosure follows two earlier incidents. According to BleepingComputer, Nikkei revealed earlier in October that hackers had compromised an employee's Google Workspace account in late July and accessed personal information of employees and business partners. In September, threat actors hijacked another employee's Microsoft 365 account and used it to send spear-phishing emails to staff.

All three incidents share a common thread: attackers gained entry through legitimate accounts rather than by exploiting a software vulnerability, based on the details the company has shared so far. Nikkei employs more than 10,100 people and reports annual revenue of about ¥393.8 billion (around $2.5 billion), according to the report.

What to do

People who receive a notification from Nikkei should be alert to phishing emails or calls that reference their account or subscription, since names, emails and phone numbers are the kind of data typically used in follow-up scams. Changing reused passwords and enabling multi-factor authentication on related accounts is a sensible precaution.

For organizations, the case is a reminder that development and test environments often hold real personal data while receiving less protection than production systems. Enforcing phishing-resistant multi-factor authentication, monitoring for logins with valid but stolen credentials, and keeping production data out of development systems can reduce the impact of similar intrusions.