Nikkei reports third data breach in about a month, exposing 1.83 million records

Nikkei Inc. says a new breach exposed 1.83 million personal information records, making it the company’s third disclosed cybersecurity incident in about a month. The company said most of the records contained no identifying information.

At least one type of personal data appeared in 150,000 records. These included full names, email addresses, physical addresses, telephone numbers and dates of birth. Email addresses appeared in 120,000 records. The other 1.68 million records contained no identifiers, Nikkei said. No credit card information was exposed.

According to a company notice, attackers used stolen credentials to access a development system on its network during the early morning of October 7. The access exposed personal information stored in the cloud. Nikkei revoked the credentials and notified Japan’s Personal Information Protection Commission on October 11.

Nikkei is still examining the breach. As of October 16, it said it had no evidence that the accessed information had been misused or leaked online, and no signs of system compromise or data tampering. The company reported no service outages and said it would notify affected people individually.

The earlier incidents involved an employee’s Google Workspace account, compromised in late July, and another employee’s Microsoft 365 account, which was hijacked in September and used to send spear-phishing emails to staff.