Nikkei Inc., the Japanese owner of the Financial Times and one of the largest media and financial groups in Japan, has announced a new security breach, marking the third of its kind in just about a month. The company explained that the security incident led to the exposure of approximately 1.83 million records of personal information stored on the cloud.
According to the statement released by the company, hackers used stolen credentials to gain unauthorized access to one of the development systems within its network in the early hours of October 7. Nikkei moved quickly to revoke the compromised credentials and notified Japan's Personal Information Protection Commission on October 11.
Nature and Scope of Affected Data
The company stated that the majority of the exposed records did not contain direct identifying information, as 1.68 million records were free of any personal identifiers, and no credit card information was affected in this incident. However, at least 150,000 records included at least one type of sensitive data:
- Full names
- Email addresses (appeared in 120,000 records)
- Physical mailing addresses
- Phone numbers
- Payment or birth dates
Current Status and Response Measures
Nikkei confirmed that as of October 16, it has no evidence suggesting that the accessed information has been misused or leaked online. Furthermore, it has not observed any signs of system compromise, data tampering, or operational service disruptions. The company will send individual notifications to users affected by the incident.
Why does this news matter?
This incident represents a new link in a consecutive series of security attacks that have targeted the Japanese organization recently. In early October, the company disclosed a breach dating back to the end of last July that targeted a Google Workspace user account. Prior to that, in September, another account on Microsoft 365 was compromised and used to send phishing messages to employees. These recurring incidents highlight the ongoing challenges faced by major organizations in securing account credentials and cloud development systems against sophisticated breaches.