Nikkei discloses third data breach in a month, exposing 1.83 million records

Nikkei publicly disclosed a data breach on October 16, 2026, after attackers used stolen credentials to access its development system on October 7, 2026. The disclosure came as the company confirmed that approximately 1.83 million personal information records had been exposed in the incident.

The breach exposed approximately 1.83 million personal information records, of which 150,000 contained at least one piece of personally identifiable information. e-mail addresses appeared in 120,000 of those records. The remaining 1.68 million records held no identifiable information. Nikkei confirmed that the breach exposed no credit card information.

Nikkei has confirmed the loss of about 1.83 million records but has not yet determined how many distinct individuals those records represent. The breach exposed personal information that Nikkei stored in the cloud, though the company has not disclosed the identity of the cloud service provider. Nikkei has not yet clarified how the attackers gained entry, whether via phishing, compromised credentials, or another approach.

This incident marks the third cybersecurity event Nikkei has disclosed within roughly one month. All three incidents involved unauthorized access to cloud services, yet Nikkei has not established a connection between them or identified a common threat actor.

In late July 2026, hackers compromised an employee’s Google Workspace account and accessed personal information of employees and business partners. Nikkei discovered the intrusion in early August after receiving an alert from Google, at which point it reset the account password. Nikkei indicated that the exposed data might have comprised names and e-mail addresses, yet it did not hold any information about its readers or journalistic sources. The compromise potentially exposed personal information belonging to approximately 1,646 employees and business partners.

During that incident, Nikkei said it saw no indication that journalistic sources or reporting material had been exposed.

In September 2026, threat actors hijacked an employee’s Microsoft 365 account and used it to send approximately 9,000 phishing e-mails. The messages, sent on September 30, contained links to malicious websites and targeted employees as well as external contacts who had communicated with Nikkei journalists. Nikkei contacted recipients and asked them to delete the malicious e-mails, while also warning of a possible increase in spoofed messages impersonating the company or its affiliates. The firm said the breach could have exposed recipients’ names, e-mail addresses and the contents of some e-mails.

Nikkei BP disclosed that an employee e-mail account accessed via phishing exposed 26 names and e-mail addresses, highlighting the reach of the campaign.

Attackers used stolen credentials to access a Nikkei development system in the early morning hours of October 7, 2026. Nikkei revoked the compromised credentials, reported the incident to Japan’s Personal Information Protection Commission on October 11, and shut down the unauthorized access points. The company said it found no evidence that attackers had misused the accessed information or leaked it online as of October 16. Nikkei also reported no signs of system compromise, data tampering or service outages resulting from the incident.

Individuals whose personal information the breach exposed will receive individual notifications from the company.

Nikkei stated it is working urgently to determine the cause of the breach and will implement necessary security strengthening measures. The company said it is examining the scope of the incident to understand what data the breach accessed and how many people the breach may affect. Post‑incident corrective actions include assessing the full scope of the breach and implementing security reinforcements. Nikkei noted that any further action or broader notifications will depend on the findings of its ongoing investigation.

As of October 16, Nikkei said the investigation into the breach remains ongoing and that it continues to investigate the source of the stolen credentials. The firm also said it is working to determine the full extent of the exposed information and whether they need any further steps. Nikkei notified the Personal Information Protection Commission on October 11, establishing a regulatory touchpoint while the review proceeds. The company has not disclosed whether the October intrusion resulted from phishing, reused credentials or another approach, leaving the entry method uncertain.

Nikkei has found no evidence that the accessed information was misused or leaked online. No threat actor group has been publicly identified as responsible for the latest intrusion.

Nikkei is a major Japanese business news and financial information group that owns the Financial Times. It employs over 10,100 people and reports annual revenue of $2.5 billion, which equals ¥393.8 billion. The company said it will tighten its handling of personal information and strengthen its defenses against unauthorized access.

Nikkei BP and Nikkei National Geographic announced on October 17 that the compromised dataset could include user information from their services. Both subsidiaries said their investigations into possible exposure were still under way. They have not publicly established how many customers the breach might affect or which categories of information the breach involved. Nikkei treats these potential exposures as part of the broader investigation into the development cloud incident and does not count them as separate confirmed breaches.

Nikkei reported in November 2025 that malware had infected an employee’s computer, harvesting credentials that attackers later used to log into its internal Slack system. The breach could have revealed names, e-mail addresses and chat logs for over 17,000 staff and partners. During that episode, Nikkei said it saw no sign that attackers had accessed journalistic sources or reporting material. In 2022, ransomware struck Nikkei’s Singapore headquarters, and the company said it could have compromised customer data.

In 2019, Nikkei America lost about $29m in a business e-mail compromise scam. Nikkei has warned that more suspicious messages posing as Nikkei or its group companies may follow, citing the risk of future spoofed e-mails.

According to Rankiteo, the breach was detected on October 7, 2023, a date that conflicts with other sources citing October 2026. Rankiteo assigns the incident a cybersecurity severity rating of 85 and an impact rating of 4. The firm’s explanation characterizes the attack as having significant impact with customer data leaks. Rankiteo lists the investigation as still underway and notes that post‑incident corrective actions include assessing the full scope and implementing security reinforcements.