Nikkei discloses breaches of employees’ Microsoft, Google email accounts

Nikkei experienced two separate email account breaches involving employee accounts on Google Workspace and Microsoft 365. The first breach, detected in early August, involved unauthorized access to a Google Workspace account in late July, exposing personal information of employees and business partners. The second breach occurred in September when attackers accessed a Microsoft 365 account and sent thousands of phishing emails internally and to interviewees. Nikkei responded by changing passwords and notifying affected parties. The company has not confirmed any ongoing unauthorized access or linked the two breaches. These incidents follow previous security events at Nikkei, including a Slack breach, ransomware attack, and a business email compromise.

The breaches exposed personal information of 1,646 employees and business partners and facilitated a large-scale phishing campaign targeting Nikkei staff and interviewees. The phishing emails contained links to malicious websites, potentially increasing the risk of credential theft or malware infections among recipients. There is no indication that reader or interviewee data was compromised beyond email contact information. No further unauthorized access has been detected since remediation steps were taken.

Nikkei has changed the passwords of the compromised accounts and contacted affected individuals to delete phishing emails. No unauthorized logins have been confirmed since these actions. Affected individuals are advised to remain vigilant for suspicious emails impersonating Nikkei or its subsidiaries. Organizations should ensure strong password policies and multi-factor authentication are in place for email accounts to reduce the risk of similar breaches.