Nikkei Inc. has confirmed that attackers used stolen credentials to get into a cloud service the company uses for system development, and that about 1.83 million items of personal information were leaked. The company's own announcement, published October 16, says about 150,000 of those items contained identifying details such as names, email addresses, postal addresses, phone numbers or dates of birth. The remaining 1.68 million items held only data that cannot identify an individual. Nikkei says no credit card data was involved. This is the Japanese media group's third disclosed compromise in about two weeks, after two employee email account breaches it announced on October 4.
What Happened
Nikkei's notice is the only first-party account of this incident. It says the intrusion lasted only a few hours: unauthorized access ran "from the early hours to the morning of October 7," and personal information stored in the cloud environment was exfiltrated during that window. Nikkei reported the breach to Japan's Personal Information Protection Commission (PPC) on October 11 and went public five days later. The credentials used in the attack have been disabled.
As of October 16, Nikkei says it has found no secondary damage such as misuse of the leaked data, and no system outages or data tampering. The company is still reviewing the scope of the breach and plans to contact each person whose data is confirmed as leaked. Nikkei has not named the cloud service, the attacker or the root cause.
A note on sourcing: none of the established security outlets in this source set (BleepingComputer, Infosecurity Magazine, The Record) had covered the 1.83 million record incident at the time of writing. Their reporting covers the two earlier email account breaches. Coverage of the cloud incident so far comes from Nikkei's own notice and from secondary sites (BigGo Finance, Hakky Handbook, SmartScope) that summarise it.
The earlier incidents, disclosed October 4:
- Google Workspace: an outside party accessed an employee's account from late July. Nikkei found out in early August after Google notified it, then changed the password. The names and email addresses of 1,646 employees, business partners and others may have been exposed. Nikkei says no reader or news source data was involved (BleepingComputer, Infosecurity Magazine, The Record).
- Microsoft 365: a different employee's account was compromised and used on September 30 to send about 9,000 emails with links to malicious sites. The recipients were internal staff and interviewees who had been in contact with several Nikkei journalists. Recipients' names, email addresses and the contents of some emails may have leaked. The number of people affected is still being determined (The Record, Infosecurity Magazine, emailexpert).
Nikkei has not said whether any of the three incidents are connected. The October 7 cloud intrusion happened three days after the email breaches were disclosed. That timing is worth noting, but no source establishes a link.
What Was Taken
According to Nikkei's notice, the roughly 1.83 million leaked items break down as follows:
- About 150,000 items contained one or more of: name, email address, postal address, phone number or date of birth.
- About 120,000 of those included an email address.
- About 1.68 million items contained only information that cannot identify an individual on its own.
- No credit card information was included.
Secondary accounts describe the data differently:
- BigGo Finance: says the 150,000 identifiable records "may contain" names, emails, addresses and phone numbers. It leaves out dates of birth, which Nikkei's notice lists.
- Hakky Handbook: states without qualification that the leaked information "includes names, email addresses, physical addresses, phone numbers, and dates of birth." It does not separate out the 1.68 million non-identifying items, which can read as if all 1.83 million records carry full PII. Nikkei's own breakdown does not support that reading. Hakky also labels its summary as AI-generated.
Several important questions are still unanswered:
- Affected services: Nikkei has not said which services or registration periods the data relates to, such as the Nikkei Online Edition or Nikkei ID. SmartScope notes that this means users cannot work out from their own account history whether they are affected.
- Passwords: Nikkei has not disclosed whether user passwords or password hashes were in the leaked data, and has issued no general password reset instruction (SmartScope).
- Why the data was there: Nikkei has not explained why personal data was stored in a development environment at all.
Why It Matters
Development environments hold production data. The central lesson is that a cloud service used "for system development" held personal information on 1.83 million records. Development and staging environments often get production data copies for testing, but with looser access controls, weaker monitoring and broadly shared credentials. Hakky Handbook places the incident alongside other recent Japanese breaches that began in third-party or non-production environments. It cites a Daiwa Securities vendor incident (220,000 records) and JR East's "Ekinet" service (2.06 million records). Those comparisons are Hakky's own and have not been independently verified here.
The compromises are piling up. BigGo notes that the cloud breach follows "multiple other security incidents, including unauthorized logins to business software." BleepingComputer documents a longer record:
- a Slack breach last year affecting more than 17,000 employees and business partners
- a May 2022 ransomware attack on Nikkei's Singapore subsidiary
- a 2019 business email compromise that cost the company about $29 million
Three account or credential compromises disclosed within two weeks suggest a systemic problem with identity security, not an isolated failure.
A media organisation is a high-value target. The September 30 phishing wave went to journalistic sources. Combined with stolen contact data, that creates real risk for source confidentiality and for follow-on social engineering. As emailexpert points out, messages sent from a genuinely compromised Microsoft 365 mailbox pass SPF, DKIM and DMARC. Recipients' filters see a known correspondent sending from its usual platform. Leaked names, emails, addresses and phone numbers give attackers the material to build convincing lures that impersonate Nikkei.
The Attack Technique
Nikkei says only that the credentials used to access the cloud service "were stolen by unknown means." The company has not disclosed:
- which cloud provider or service was involved
- the type of credential, such as a user password, API key, access token or service account secret
- whether multi-factor authentication was enabled
- how the theft happened
What the sources do establish:
- Valid credentials, no exploit: the attack used legitimate credentials, not a software vulnerability, so it would look like authorised activity.
- Fast exfiltration: the attacker took data within a window of a few hours on October 7. Hakky reads this as a sign the attacker knew where the data was or moved quickly once inside. That is an inference, not a confirmed finding.
- Detection and response: Nikkei detected the activity, filed with the PPC within four days and disabled the credentials.
- The earlier breaches were also identity-based. Neither involved a technical exploit. Nikkei learned of the Google Workspace takeover from an external notification by Google, not its own detection. Nikkei has not said how either account was compromised.
The common thread across all three incidents is stolen or misused credentials for cloud services. The sources do not establish whether a single actor, a shared credential source (such as infostealer logs or a phished employee) or separate events explain them.
What Organizations Should Do
- Keep real PII out of development environments. Use synthetic, masked or tokenised data for development and testing. If production data must be used, apply the same access controls, logging and retention limits as production.
- Inventory and rotate non-human credentials. Find every API key, access token and service account with access to cloud development tooling. Replace long-lived static secrets with short-lived, federated credentials, and scope each to the minimum data it needs.
- Enforce phishing-resistant MFA on cloud and SaaS identities. Use FIDO2 or passkeys for Microsoft 365, Google Workspace and cloud provider consoles. After any account takeover, revoke active sessions and OAuth grants in addition to resetting passwords.
- Alert on bulk data access and unusual sign-in times. An intrusion confined to a few early-morning hours is exactly what anomaly detection on unusual hours, new source IPs and large reads or exports from storage should catch.
- Treat a cluster of incidents as one investigation. When several account compromises surface close together, check them for a shared root cause before closing each one. Look in particular for infostealer infections on employee devices and reused or synced credentials.
- Prepare stakeholders for follow-on phishing. Warn employees, partners and customers that convincing Nikkei-branded lures are likely. Publish one authoritative contact channel, and give recipients a way to verify messages out-of-band.
Sources: Personal Information Leak Due to Unauthorized Access : WHAT'S NEW... | Nikkei discloses breaches of employees’ Microsoft, Google email acc... | Nikkei Discloses Two Employee Cloud Account Compromises - Infosecur... | Japanese media group Nikkei discloses intrusions targeting employee... | Nikkei Reports 1.83 Million Personal Data Records Leaked in Cloud U... | Nikkei Data Breach: 1.83 Million Records Exposed Hakky Handbook | Nikkei Data Breach: Breakdown of Approximately 1.83 Million Records... | Nikkei says a hacked Microsoft 365 account sent ... - emailexpert