Nikkei Inc. has announced another data breach, representing the third such incident within approximately one month, compromising 1.83 million personal information records. The organization indicated that while certain portions of the exposed dataset included personally identifiable information and other confidential details, the majority of records lacked identifying markers.
Among the compromised records, 150,000 contained at least one category of sensitive data including full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses alone appeared across 120,000 records. The remaining 1.68 million records contained no identifiers, according to the company, and no payment card information was included in the breach.
Nikkei Inc. operates as a major Japanese business news and financial information organization, holding ownership of the Financial Times and functioning as the country's largest business-focused media enterprise. The organization maintains a workforce exceeding 10,100 employees and generates annual revenue of $2.5 billion (¥393.8 billion).
Attack timeline and investigation
According to a statement released by Nikkei the previous week, attackers leveraged compromised login credentials to breach a development system on the company's network during the early hours of October 7. The intrusion granted access to personal information maintained within the organization's cloud infrastructure. Nikkei disabled the compromised credentials and reported the incident to the Personal Information Protection Commission on October 11.
The organization is actively investigating the incident's full scope. As of October 16, Nikkei reported no evidence indicating the accessed information had been misused or published online. The company has also detected no indicators of system compromise, data modification, or service disruptions stemming from this breach.
Affected individuals will receive direct notifications regarding the incident. "We are working urgently to establish the extent of the damage and determine the cause, and will implement the necessary measures to strengthen security," Nikkei stated.
Pattern of recent incidents
This latest breach represents the third cybersecurity incident Nikkei has publicly disclosed in recent weeks. Earlier in the month, the organization revealed a separate breach originating in late July, during which attackers compromised an employee's Google Workspace account and obtained personal information belonging to staff members and business associates.
Additionally, during September, threat actors gained control of another employee's Microsoft 365 account and leveraged it to distribute spear-phishing messages targeting the company's workforce.