Nikkei discloses theft of 1.83 million records from cloud development service via previously compromised credentials
Japanese media group Nikkei (publisher of The Nikkei and the Financial Times) disclosed a data breach affecting about 1.83 million records held in a cloud service used for system development. On the morning of October 7, attackers used previously compromised credentials to access the service. About 1.68 million records held only non-identifying information, while roughly 150,000 contained names, addresses, email addresses, phone numbers and dates of birth, and about 120,000 contained email addresses only. No credit card data was affected. As of October 16, Nikkei had found no evidence of misuse, and it reported no disruption or data tampering. The incident follows a previous Nikkei breach, disclosed less than a year earlier, that stemmed from a Slack account compromise.
Technical Details
- Initial access was through valid, previously compromised credentials for a cloud development service. The article does not name the service or say how the credentials were obtained.
- Nikkei has not attributed the attack to any threat actor.
- Nikkei revoked the compromised credentials immediately after detection and notified regulators. The investigation into scope and data nature is continuing.
Remediation
- Nikkei revoked the compromised credentials and says it will apply further security measures if needed.
- Nikkei will notify affected individuals if leakage of personal information is confirmed.
- Defenders should rotate credentials and enforce MFA on cloud development and SaaS services. This is general guidance, not stated in the article.
Linha do tempo
-
Nikkei discloses theft of 1.83 million records from cloud development service via previously compromised credentials
ler a análise desta fonte ocultar
Japanese media group Nikkei (publisher of The Nikkei and the Financial Times) disclosed a data breach affecting about 1.83 million records held in a cloud service used for system development. On the morning of October 7, attackers used previously compromised credentials to access the service. About 1.68 million records held only non-identifying information, while roughly 150,000 contained names, addresses, email addresses, phone numbers and dates of birth, and about 120,000 contained email addresses only. No credit card data was affected. As of October 16, Nikkei had found no evidence of misuse, and it reported no disruption or data tampering. The incident follows a previous Nikkei breach, disclosed less than a year earlier, that stemmed from a Slack account compromise.
Technical Details
- Initial access was through valid, previously compromised credentials for a cloud development service. The article does not name the service or say how the credentials were obtained.
- Nikkei has not attributed the attack to any threat actor.
- Nikkei revoked the compromised credentials immediately after detection and notified regulators. The investigation into scope and data nature is continuing.
Remediation
- Nikkei revoked the compromised credentials and says it will apply further security measures if needed.
- Nikkei will notify affected individuals if leakage of personal information is confirmed.
- Defenders should rotate credentials and enforce MFA on cloud development and SaaS services. This is general guidance, not stated in the article.