Nikkei discloses third data breach in a month, 1.8M records exposed

Nikkei Inc. experienced a data breach on October 7, 2026, where attackers used stolen credentials to access a development system within its network, exposing 1.83 million records of personal information stored in the cloud. Approximately 150,000 records contained personally identifiable information including names, emails, addresses, phone numbers, and birth dates, with 120,000 email addresses specifically exposed. The remaining 1.68 million records lacked identifying information. No credit card data was compromised. The company promptly revoked the stolen credentials, notified the Personal Information Protection Commission, and is conducting an ongoing investigation. There is currently no evidence of data misuse, tampering, or service disruption. This breach is the third recent cybersecurity incident for Nikkei, following compromises of employee Google Workspace and Microsoft 365 accounts earlier in the same month.

The breach exposed a significant volume of personal information, including sensitive identifiers for approximately 150,000 individuals, which could increase risks of identity theft or targeted phishing attacks. However, no financial data such as credit card information was exposed. There is no current evidence that the stolen data has been misused or leaked publicly. The breach may affect employee and business partner privacy and could impact the company's reputation and regulatory compliance obligations.

Nikkei has revoked the compromised credentials and notified the relevant regulatory authority. The company is investigating the breach to determine its full scope and is implementing measures to strengthen security. Affected individuals will receive notifications. No further immediate action is indicated based on current information, but continued monitoring and security enhancements are recommended.