1.83 Million Records Exposed in Latest Nikkei Security Incident
Nikkei Inc., the Japanese business news and financial information group that owns the Financial Times, disclosed a third data breach in approximately one month. Attackers used stolen credentials to access a development system on October 7, exposing 1.83 million personal information records stored in the cloud. The company revoked the compromised credentials and notified the Personal Information Protection Commission on October 11. Of the exposed records, 150,000 contained personally identifiable information including names, email addresses, physical addresses, telephone numbers and dates of birth. The remaining 1.68 million records contained no identifiers. As of October 16, Nikkei reported no evidence the accessed information was misused or leaked.
Details of the October Breach
Nikkei published a notice stating that unauthorized access occurred during the early morning hours of October 7. Attackers used stolen credentials to enter a development system within the company network that stored personal information in the cloud.
The company revoked the credentials and notified Japan's Personal Information Protection Commission on October 11. As of October 16, Nikkei reported it had found no evidence the accessed information was misused or leaked online, no signs of system compromise or data tampering, and no service outages.
Scope of Exposed Information
The breach exposed 1.83 million records. Of these, 150,000 records contained at least one type of personally identifiable information: full names, email addresses, physical addresses, telephone numbers or dates of birth. Email addresses appeared in 120,000 records.
The remaining 1.68 million records contained no identifying information, according to Nikkei. The company confirmed that no credit card information was exposed. Nikkei stated that affected individuals will receive individual notifications.
Recent Pattern of Security Incidents
This is the third cybersecurity incident Nikkei disclosed recently. Earlier in October, the company announced a breach that occurred in late July, when an employee Google Workspace account was compromised and personal information of employees and business partners was accessed.
Earlier, Nikkei had announced that an employee Microsoft 365 account was hijacked and used to send spear-phishing emails to company staff. All three incidents involved compromised employee accounts, though the company has not disclosed whether the same threat actors were responsible.
Development System Access and Detection
The attackers accessed a development system using stolen credentials and exposed data stored in the cloud. Nikkei reported no signs of system compromise, data tampering or service outages from this incident.
The company has not disclosed how the credentials were initially stolen or what specific security measures it plans to deploy going forward. Nikkei stated it is working urgently to establish the full extent of the damage and determine the cause.
Company Response and Investigation
Nikkei pledged to implement necessary measures to strengthen security. The company employs over 10,100 people and has annual revenue of approximately 393.8 billion yen (around $2.5 billion).
The firm said it is examining the scope of the breach and will notify affected individuals. Nikkei stated it is working urgently to establish the full extent of damage and determine the cause.
Steps to Protect Against Credential Theft
Organizations can reduce exposure from stolen credentials by segmenting access according to job role, implementing phishing-resistant multifactor authentication, and monitoring unusual data queries. Valid credentials allow attackers to bypass many perimeter security controls.
Individuals who receive breach notification should watch for phishing attempts using their exposed details. Verify any unexpected request by contacting the organization through an official channel you look up independently. If you reused the same email and password combination on other accounts, change those passwords.
- Watch for phishing messages that reference your name, email or other exposed information
- Verify unexpected requests by contacting the organization through an official channel you find yourself
- Review whether you reused the exposed email and password combination on other accounts
- Change passwords on any accounts that share credentials with the breached service
- Consider using unique passwords for each account and a password manager to track them
Questions readers ask
How many records in the Nikkei breach contained personally identifiable information?
Nikkei stated that 150,000 of the 1.83 million exposed records contained at least one type of personally identifiable information, such as full names, email addresses, physical addresses, telephone numbers or dates of birth. Email addresses appeared in 120,000 of those records. The remaining 1.68 million records contained no identifying information.
Was credit card information exposed in this breach?
No. Nikkei confirmed that no credit card information was exposed in this incident.
How did attackers access Nikkei systems in the October breach?
According to Nikkei, attackers used stolen credentials to access a development system within the company network during the early morning hours of October 7. The company did not disclose how the credentials were initially stolen.
How many data breaches has Nikkei disclosed recently?
This is the third cybersecurity incident Nikkei disclosed in approximately one month. Earlier in October, the company announced a breach from late July involving a compromised Google Workspace account. The firm had also announced that an employee Microsoft 365 account was hijacked and used to send spear-phishing emails to staff.
What should I do if Nikkei notifies me that my information was exposed?
Watch for phishing attempts that use your exposed details to appear legitimate. Verify any unexpected message by contacting Nikkei or the claimed sender through an official channel you look up yourself, not by replying. If you reused the same email and password combination on other accounts, change those passwords.
Source and reporting limits
Based on reporting by BleepingComputer. This automated brief is not independent verification. Claims are attributed to the reporting source; later developments may change the picture.