Nikkei discloses third data breach in a month, 1.8M records exposed

Nikkei Inc. has disclosed a data breach that exposed 1.83 million personal information records, the third cybersecurity incident the Japanese business news and financial information group has reported in about a month. According to a notice the company published late last week, hackers used stolen credentials to reach a development system inside its network during the early morning hours of October 7. The unauthorized access exposed personal information Nikkei stored in the cloud.

Most of the affected records carry no identifying details. Nikkei said 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses appeared in 120,000 records, and the remaining 1.68 million records contain no identifiers.

Nikkei said no credit card information was exposed. The company revoked the abused credentials and notified the Personal Information Protection Commission on October 11. It is still examining the scope of the breach and said that as of October 16 it had no evidence the accessed information was misused or leaked online.

Nikkei also reported no signs of system compromise or data tampering from the incident and no service outages. The company said it is working urgently to establish the extent of the damage and determine the cause, and will put in place the measures needed to strengthen security.

The disclosure follows two other incidents at Nikkei. Earlier this month, the company reported a breach that occurred in late July, when hackers compromised an employee's Google Workspace account and accessed personal information belonging to employees and business partners. In September, Nikkei announced that threat actors hijacked another employee's Microsoft 365 account and used it to send spear-phishing emails to the firm's staff.

Nikkei Inc. owns the Financial Times and describes itself as the country's largest business-focused media company. It employs over 10,100 people and has annual revenue of $2.5 billion (393.8 billion). The incident adds to a run of credential-based intrusions at Japanese media and entertainment companies, including the Nippon Columbia malware incident that exposed 8.6 million karaoke fan records.

More cybersecurity news from TechManNews.