Nikkei Inc. disclosed a new data breach, the third in about a month, that exposed 1.83 million personal information records.
The Japanese giant says subsets of the data contained personally identifiable information and other sensitive details, but most records contained no identifying info.
The company said that 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records.
The remaining 1.68 million records contain no identifiers, the company said, and no credit card information was exposed.
Nikkei Inc. is a major Japanese business news and financial information group, owner of Financial Times, the country’s largest business-focused media company.
The company employs over 10,100 people and has an annual revenue of $2.5 billion (¥393.8 billion).
According to a notice Nikkei published late last week, hackers used stolen credentials to access a development system within its network during the early morning hours of October 7.
The unauthorized access exposed personal information the company stored in the cloud.
Nikkei revoked the abused credentials and notified the Personal Information Protection Commission on October 11.
The company is currently examining the scope of the breach and noted that as of October 16, it had no evidence that the accessed information was misused or leaked online.
The company has also found no signs of system compromise or data tampering resulting from this incident, and has experienced no service outages.
The firm said those affected will receive individual notifications.
“We are working urgently to establish the extent of the damage and determine the cause, and will implement the necessary measures to strengthen security,” Nikkei stated.
This is the third cybersecurity incident that Nikkei disclosed recently. Earlier this month, the company disclosed a breach that occurred in late July, when hackers compromised an employee's Google Workspace account and accessed personal information belonging to employees and business partners.
In September, Nikkei announced that threat actors hijacked another employee’s Microsoft 365 account and used it to send spear-phishing emails to the firm’s staff.
BleepingComputer has contacted Nikkei for more information about the latest breach, and we will update this post once we receive a response.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.