Nikkei discloses breach of cloud development service via stolen credentials, exposing 1.83 million records
Nikkei Inc., the Japanese media group that owns The Nikkei and the Financial Times, disclosed a breach of a cloud service used for system development. On October 7, attackers used previously stolen credentials to gain unauthorized access. As of October 16, about 1.83 million items of personal information had leaked. The company reported the incident to Japan's Personal Information Protection Commission on October 11 and is still investigating the scope. This is Nikkei's third publicly reported incident, after a ransomware attack in May 2022 and a Slack account compromise in November 2025.
Technical Details
- Initial access was through valid, previously stolen credentials on a cloud development service; the article does not name the provider.
- About 150,000 items contained one or more of: name, email address, postal address, phone number or date of birth. About 120,000 of these included an email address.
- About 1.68 million items contained only information that cannot identify an individual.
- No credit card information or other financial data was exposed.
- As of October 16, Nikkei had found no signs of data misuse, system outages or data changes.
- No threat actor attribution or IOCs were published.
Remediation
- Nikkei has blocked the stolen credentials, is investigating the root cause and plans to strengthen its security.
- Nikkei will notify affected individuals.
- Defenders should enforce MFA and credential rotation on cloud development services, and monitor for reuse of leaked credentials.
Linha do tempo
-
Nikkei discloses breach of cloud development service via stolen credentials, exposing 1.83 million records
ler a análise desta fonte ocultar
Nikkei Inc., the Japanese media group that owns The Nikkei and the Financial Times, disclosed a breach of a cloud service used for system development. On October 7, attackers used previously stolen credentials to gain unauthorized access. As of October 16, about 1.83 million items of personal information had leaked. The company reported the incident to Japan's Personal Information Protection Commission on October 11 and is still investigating the scope. This is Nikkei's third publicly reported incident, after a ransomware attack in May 2022 and a Slack account compromise in November 2025.
Technical Details
- Initial access was through valid, previously stolen credentials on a cloud development service; the article does not name the provider.
- About 150,000 items contained one or more of: name, email address, postal address, phone number or date of birth. About 120,000 of these included an email address.
- About 1.68 million items contained only information that cannot identify an individual.
- No credit card information or other financial data was exposed.
- As of October 16, Nikkei had found no signs of data misuse, system outages or data changes.
- No threat actor attribution or IOCs were published.
Remediation
- Nikkei has blocked the stolen credentials, is investigating the root cause and plans to strengthen its security.
- Nikkei will notify affected individuals.
- Defenders should enforce MFA and credential rotation on cloud development services, and monitor for reuse of leaked credentials.