Nikkei discloses third data breach in about a month, exposing about 1.83 million records

Nikkei Inc. has disclosed a data breach exposing approximately 1.83 million items of personal information through unauthorized access to a development system, according to the company's notice. BleepingComputer counts it as Nikkei's third breach disclosure in about a month.

Hackers gained entry via stolen credentials on October 7. The Japanese media company said attackers used the credentials to reach a cloud-based development system in the early morning hours of that date. Nikkei revoked the credentials after detecting the activity and notified Japan's Personal Information Protection Commission on October 11.

As of October 16 the company reported no evidence that the accessed data had been misused or posted online. It also found no signs of broader system compromise, data tampering, or service outages.

Most records lack identifying details. Of the roughly 1.83 million records, about 150,000 contained at least one identifier such as full names, email addresses, physical addresses, telephone numbers, or dates of birth. Email addresses appeared in about 120,000 of those records.

The remaining roughly 1.68 million records held no identifying information, and no credit card data was exposed in any portion of the breach. Affected individuals will receive individual notifications, the company said.

Nikkei outlines response and prior incidents. “We are working urgently to establish the extent of the damage and determine the cause, and will implement the necessary measures to strengthen security,” Nikkei stated. According to BleepingComputer, the latest incident follows two earlier disclosures: a breach of an employee’s Google Workspace account dating to July, and a hijacked Microsoft 365 account used for spear-phishing emails, announced in September.