Nikkei, the major Japanese publishing corporation, announced over the weekend that attackers had gained unauthorized access to email accounts belonging to two of its employees and weaponized one of them to launch a large-scale phishing campaign.
According to a statement released on Sunday, a Google Workspace account operated by an employee fell under attacker control during late July. The intrusion exposed personal details belonging to 1,646 individuals, including both Nikkei staff and external business contacts. However, the company clarified that the compromised data set did not contain information about readers or interview subjects. Following notification from Google, Nikkei secured the account by resetting its password in early August.
A second incident unfolded in September when threat actors obtained access to a Microsoft 365 account held by another employee. The attackers subsequently dispatched approximately 9,000 phishing messages directed at Nikkei personnel and individuals the company had interviewed.
On September 30th , emails containing links to malicious websites were sent to internal staff and to interviewees with whom several employees had been in contact. Our company has changed its passwords, and no unauthorized logins have been confirmed since then. We have contacted the recipients individually and requested that they delete the emails.
Nikkei
Nikkei cautioned recipients of the malicious messages to remain vigilant for follow-up phishing attempts that could impersonate the company or its subsidiary organizations.
The organization has not yet identified which threat actor or group carried out the attacks, nor has it determined whether the two breaches are connected.
These incidents represent the latest in a series of security compromises affecting Nikkei. The company disclosed in the previous year that its Slack workspace had been breached, impacting more than 17,000 employees and business associates. In May 2022, attackers deployed ransomware against Nikkei's Singapore-based subsidiary, targeting a server believed to contain customer information. Additionally, in September 2019, Nikkei America fell victim to a business email compromise attack that resulted in approximately $29 million in losses.
Nikkei operates as one of the world's largest media organizations, owning the Financial Times and The Nikkei newspaper, which ranks as the world's biggest financial publication by circulation. The conglomerate manages a portfolio exceeding 40 subsidiary companies spanning publishing, broadcasting, events, database services, and financial indices. Its global presence includes 37 international news bureaus staffed by over 1,500 journalists, and the company maintains more than 3.7 million digital subscribers.