Nikkei admits millions of records stolen after reporting third breach in a month
Nikkei has revealed that more than a million records have been stolen, but said most can't be used to identify an individual
Japanese media giant Nikkei, owner of financial publications including the Nikkei and the Financial Times, has revealed a data breach in which 1.83 million records have been stolen.
The incident, which took place from the early hours of 7 October, involved the unauthorized access of a cloud service used by the firm for system development.
Nikkei said the credentials that were used have now been disabled, and that it doesn't yet know how they were stolen.
"As of October 16, we have found no secondary damage, such as misuse of the leaked personal information," said the firm. "We have also found no other problems, such as Nikkei system outages or data tampering."
Of the 1.83 million records that were stolen, around 150,000 contained one or more name, email address, postal address, phone number, or date of birth. Of these, about 120,000 included an email address - putting these people at risk of phishing attempts.
About 1.68 million items contained information that couldn't be used to identify an individual, Nikkei said, and no credit card information was leaked.
The firm said it's now working to assess the extent of the damage and find the cause, and that it is contacting all those whose data has been affected.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
It has also reported the incident to Japan's Personal Information Protection Commission, but has found no evidence that the leaked data has been misused in any way.
"For businesses, this incident highlights the importance of strong access controls and protecting employee credentials. Implementing multi-factor authentication, regularly reviewing account permissions and monitoring for suspicious login activity can significantly reduce the risk of unauthorized access," commented Jamie Akhtar, CEO and co-founder of CyberSmart.
"Employee cybersecurity awareness training is equally important, helping staff recognise phishing attempts and avoid inadvertently exposing sensitive information."
A hat-trick of Nikkei breaches
The breach is the third to have hit the company in the last few weeks. Earlier this month, it disclosed a breach that occurred in late July, when hackers compromised employees’ Microsoft 365 business software accounts and accessed personal information belonging to employees and business partners.
It also revealed a second breach, in which a cloud service it used had been accessed without authorization since late July.
“Three breaches in a month point toward a systemic problem that a series of individual incident responses isn’t resolving. The investigation and remediation approach clearly needs to widen beyond what’s been done so far," commented Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress.
"For an organization whose core business is the integrity and trustworthiness of financial information, a month of successive data breaches is now a reputational problem.”
Looking further back, in May 2022, the firm revealed that it had fallen victim to a ransomware attack, while, in November last year, it disclosed a data breach that was caused by the compromise of a Slack account.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
