Japanese media giant Nikkei has disclosed its third cybersecurity incident in approximately 1 month, confirming that attackers used stolen credentials to access a cloud development environment and steal approximately 1.83 million records.
The October 16 disclosure follows separate incidents involving compromised Microsoft 365 and Google Workspace accounts, raising concerns about repeated unauthorized access to the company’s cloud infrastructure.
According to Nikkei, approximately 150,000 of the exposed records contained personally identifiable information, including names, email addresses, residential addresses, telephone numbers and dates of birth.
The remaining 1.68 million records reportedly contained identifiers that could not independently identify individuals. No credit card information was involved.
Nikkei, one of Japan’s largest business media organizations and the owner of the Financial Times, confirmed that the latest intrusion occurred on October 7, 2026.
Stolen credentials exposed cloud development data
The latest incident involved a cloud service used by Nikkei for system development.
According to the company’s October 16 disclosure, an unauthorized party obtained credentials associated with the service and used them to access information stored in the cloud.
The intrusion occurred during the early morning hours of October 7.
Nikkei confirmed that approximately 1.83 million records were exposed, including:
- 150,000 records: Contained at least 1 category of personal information, including names, email addresses, physical addresses, telephone numbers or dates of birth.
- 120,000 records: Included email addresses and formed part of the 150,000 records containing personal information.
- 1.68 million records: Contained identifiers that could not independently identify individuals.
The company has not disclosed the identity of the cloud service provider or explained how the credentials were initially stolen.
It also remains unclear whether the attackers obtained access through phishing, previously compromised credentials or another intrusion method.
Nikkei revoked the compromised credentials and reported the incident to Japan’s Personal Information Protection Commission on October 11.
As of October 16, the company had not identified evidence that the stolen information had been misused or publicly distributed.
Nikkei also reported no associated service outages, system tampering or additional operational disruptions.
Third security incident disclosed within weeks
The latest breach follows 2 separate incidents involving compromised employee cloud accounts.
In September, attackers hijacked a Nikkei employee’s Microsoft 365 account and used it to distribute approximately 9,000 phishing emails.
The messages reportedly targeted employees and external contacts, including individuals who had previously communicated with Nikkei journalists.
The compromised account created opportunities for attackers to impersonate a legitimate company employee and distribute malicious messages through an established communication channel.
A separate incident involving an employee’s Google Workspace account was also disclosed in October.
That compromise reportedly originated in late July and potentially exposed personal information belonging to approximately 1,646 employees and business partners.
Although all 3 incidents involved unauthorized access to cloud services, Nikkei has not established a connection between them or identified a common threat actor.
The repeated compromises nevertheless highlight the risks associated with stolen authentication credentials and unauthorized access to enterprise cloud environments.
BreachNews previously examined similar risks in its investigation of 3 active Microsoft 365 phishing campaigns, which demonstrated how attackers use credential theft to target business accounts.
Group companies investigate potential exposure
The impact of the latest breach may extend beyond Nikkei’s primary publishing operations.
On October 17, Nikkei BP and Nikkei National Geographic reportedly disclosed that information belonging to users of their services could be included in the compromised dataset.
Both organizations indicated that investigations were ongoing.
The companies had not publicly established how many customers might be affected or which categories of information were involved.
These potential exposures are part of the broader investigation into Nikkei’s development cloud incident and should not be counted as separate confirmed breaches.
Nikkei said it would individually notify people whose personal information was confirmed to have been exposed.
Repeated cloud compromises raise security concerns
The incidents illustrate how compromised credentials can expose different areas of an organization’s technology infrastructure.
In the Microsoft 365 incident, attackers reportedly exploited an employee account to distribute phishing messages.
The Google Workspace compromise involved unauthorized access to employee communications and associated information.
The latest incident targeted a cloud development environment containing a substantially larger collection of records.
Development environments can contain information used for testing, application integration and internal operations. Access to those systems may expose stored information even when production services remain operational.
The investigation has not established that the attackers accessed Nikkei’s production systems or compromised additional infrastructure.
However, the incident reinforces the importance of securing cloud credentials, restricting access permissions and monitoring authentication activity across enterprise services.
Similar concerns have emerged in other cloud-related security incidents. BreachNews recently covered a claimed Azure tenant compromise involving HCLTech employee information, although that separate allegation has not been linked to Nikkei.
Nikkei continues investigating the source of the stolen credentials and the full extent of the exposed information.
While the company has confirmed the loss of approximately 1.83 million records, the number of unique individuals affected remains unclear.
No threat actor group has been publicly identified as responsible for the latest intrusion.
