Nikkei Inc., the Japanese business news group that owns the Financial Times, has disclosed its third cybersecurity incident in about a month. A breach using stolen credentials exposed 1.83 million records, including personal information belonging to an estimated 150,000 people.
Nikkei Inc. said hackers used stolen credentials to access a development system inside its network during the early morning hours of October 7, exposing personal information stored in the cloud. The company disclosed the incident in a notice published late last week and said 150,000 of the 1.83 million records contained at least one of the following: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records. The remaining 1.68 million records contained no identifiers, the company said, and no credit card information was exposed.
Nikkei said it revoked the abused credentials and notified Japan's Personal Information Protection Commission on October 11. As of October 16, the company said it had found no evidence that the accessed information had been misused or leaked online, no signs of system compromise or data tampering, and no service outages. Those affected will receive individual notifications.
"We are working urgently to establish the extent of the damage and determine the cause, and will implement the necessary measures to strengthen security," Nikkei stated.
This is the third cybersecurity incident Nikkei has disclosed in recent weeks. Earlier in the month, the company reported a breach that occurred in late July, when hackers compromised an employee's Google Workspace account and accessed personal information belonging to employees and business partners. In September, Nikkei said threat actors hijacked another employee's Microsoft 365 account and used it to send spear-phishing emails to staff.
Nikkei Inc. is one of Japan's largest business-focused media companies, employing more than 10,100 people and reporting annual revenue of about $2.5 billion (¥393.8 billion), according to the company. BleepingComputer has contacted Nikkei for more information about the latest breach, and this article will be updated should the company respond.
Analysis
Why This Matters
- Three separate security incidents in roughly a month point to a pattern of credential-based attacks against a major global media and financial information group.
- Personal identifiers for 150,000 people, including names, addresses and dates of birth, are now in the hands of unknown attackers, creating phishing and identity fraud risks.
- The episode signals that even established media organisations with large security budgets remain vulnerable to compromised logins.
Background
Nikkei Inc. is a Japanese business news and financial information group and the owner of the Financial Times. The company holds substantial personal data on subscribers, business partners and employees, which makes it an attractive target. The three incidents disclosed this month all involve stolen or hijacked account credentials: a development system accessed with stolen credentials, a compromised Google Workspace account, and a hijacked Microsoft 365 account used for spear-phishing. This suggests the attackers are focusing on identity-based intrusion rather than exploiting software flaws.
Key Perspectives
Nikkei Inc.: The company says it is working urgently to determine the extent of the damage, has revoked the abused credentials, notified regulators, and seen no evidence of misuse or data tampering. It has pledged to strengthen security and is notifying affected individuals.
Affected users and employees: People whose names, contact details and birth dates were exposed face a heightened risk of targeted phishing, social engineering and identity fraud, and will be looking to Nikkei for clear guidance and support.
Security researchers and skeptics: The three incidents in quick succession raise questions about the effectiveness of Nikkei's credential management, multi-factor authentication and monitoring controls. Researchers may argue that repeated credential theft suggests a need for more robust identity verification and faster threat detection.
What to Watch
- Whether Nikkei's ongoing investigation expands the number of affected records or reveals that the data was actually misused.
- Any update on enforcement or inquiry from Japan's Personal Information Protection Commission.
- Whether this incident is linked to the earlier Google Workspace and Microsoft 365 compromises, which would indicate a single coordinated campaign.
- Nikkei's response on security changes, including whether it adopts additional authentication or monitoring measures in the coming weeks.
