-
Nikkei has reported another data breach in which hackers used stolen credentials to access a cloud system, compromising 1.83 million records.
-
Of the exposed data, 150,000 records hold personal information names, email addresses, physical addresses, phone numbers, or birth dates. Another 1.68 million contained identifiers that could not identify people on their own.
-
The incident follows two earlier attacks involving employee email accounts. However, Nikkei has not confirmed any link between the three incidents.
Nikkei Inc., Japan’s major business news and financial information group, has disclosed another cybersecurity incident. This time, attackers accessed a cloud system used for software development and exposed 1.83 million records.
According to the company’s statement regarding the breach on October 16, the unauthorized access happened in the early hours of October 7. While the breach exposed a large volume of data, not all the records contained personal identifiable information. Nikkei also reported no credit card exposure.
The company continues to investigate the incident. Meanwhile, it has disabled the stolen credentials and plans to notify affected individuals directly.
Stolen Credentials Exposed 1.83 Million Records
Nikkei said attackers used stolen login credentials to enter a cloud service within its network. The company uses this service for system development.
The unauthorized access exposed personal information stored in the cloud. However, Nikkei has not explained how the attackers stole the credentials or identified the cloud provider.
Also, the company hasn’t disclosed exactly how the attackers gained access to the development environment. There’s, therefore, no proof that phishing, malware, or another method was what led to the breach.
Nikkei disabled the compromised credentials to prevent further unauthorized access. It also reported the incident to Japan’s Personal Information Protection Commission on October 11.
The company announced the breach five days later. It said investigators were still examining the scope of the incident and working to determine its cause.
Only 150,000 Records Contained Identifying Details
Nikkei grouped the exposed records into two categories. About 150,000 records held at least one type of personal info like names, email address, physical address, phone numbers, and date of birth. Of this, approximately 120,000 records contain email addresses. However, Nikkei has not provided a complete breakdown of the other personal details.
The remaining 1.68 million records contained identifiers that could not identify individuals on their own, the company said. These records are still part of the exposed dataset. But they don’t contain anything that can be used to identify individuals.
Nikkei also mentioned that the incident didn’t expose credit card info. But that doesn’t make the breach less risky. Criminals can still use exposed names and email addresses to churn out convincing phishing messages.
Personal details could also help attackers make fraudulent messages look legitimate and convincing. However, Nikkei has not reported any confirmed misuse of the exposed information.
Other companies have also faced incidents involving exposed customer information. For example, ASUS warned customers after an eShop security breach exposed order data, highlighting the privacy risks that follow unauthorized access to business systems.
No Evidence of Misuse or Service Disruption
As of October 16, Nikkei said it had found no evidence that anyone had misused the accessed information or published it online.
The company also reported no signs of system compromise or data tampering resulting from the incident. Furthermore, it said the breach had not caused any service outages.
These findings describe the company’s position at the time of its announcement. They do not provide any guarantee that attackers didn’t steal the information or that there won’t be future misuse.
Nikkei continues its investigation of the damage done and the methods the attackers used to get access to the data. It also plans to contact affected individuals directly.
In the company’s statement, it says it is currently calculating the damages and determining the cause. The company also promises to make improvements in terms of security, if needed. The company did not release any further information about the nature of the attack.
Two Earlier Incidents Targeted Employee Email Accounts
The latest breach marks the third cybersecurity incident Nikkei has disclosed in roughly a month. The two earlier incidents involved employee email accounts rather than the development cloud system.
On October 4, Nikkei disclosed unauthorized access to an employee’s Google Workspace account and another employee’s Microsoft 365 account.
The Google Workspace incident began in late July, according to the company’s disclosure. Nikkei learned about the unauthorized access in early August after Google notified it.
That incident may have exposed the names and email addresses of 1,646 employees and business partners. Nikkei said the affected information did not include details about readers or interviewees.
The Microsoft 365 incident involved a different employee account. On September 30, someone used that account to send about 9,000 emails, all packed with links to bad websites.
The messages targeted Nikkei staff and people who had communicated with its employees, including interviewees. Nikkei changed the compromised account’s password and contacted recipients to request that they delete the emails.
The company also warned people to watch for suspicious messages that impersonate Nikkei or its subsidiaries.
So far, Nikkei hasn’t said who’s behind these attacks or proven they’re all connected. There’s just not enough evidence to show one person or group caused all three incidents.
Nikkei Group Companies Assess Possible Customer Exposure
The investigation also has implications for Nikkei’s wider business. On October 17, two group companies, Nikkei BP and Nikkei National Geographic, said their service users’ information might have been included in the latest breach.
Both companies said they were investigating the possible exposure. They had not disclosed the number of affected users or the specific information involved in their notices.
This development expands the potential impact beyond Nikkei Inc. itself. Nevertheless, investigators still have to figure out which users were affected and exactly what information got out.
They’re also trying to see if the breach hit customers from different services or if some records overlap. For now, the companies haven’t shared enough to show just how widespread this exposure is.
Investigation Continues
Nikkei is continuing its investigation into the October 7 incident and the circumstances surrounding the stolen credentials. While the company’s statement has already confirmed the 1.83 million accounts, it still hasn’t disclosed the full scope of the incident. The technical details of the attack remain obscure, and as of the time of reporting, there’s no evidence of misuse.
Three recent events have raised some doubts regarding how much effort Nikkei puts into securing user accounts. Investigations to establish the cause or attack campaign are underway.
Nikkei says it will notify affected individuals and strengthen its security measures. Until the company releases further findings, the extent of the damage and the possibility of future misuse remain uncertain.
