Nikkei Reports Third Data Breach in a Month, Exposing 1.83 Million Records

Nikkei Inc. has disclosed a third data breach in about a month, exposing 1.83 million personal information records. The company reported that subsets of the data included personally identifiable information, while the majority of records did not contain identifying details.

Out of the exposed records, 150,000 contained at least one type of sensitive information, including full names, email addresses, physical addresses, telephone numbers, and dates of birth. Notably, email addresses appeared in 120,000 of these records.

The remaining 1.68 million records did not include any identifiers, and the company confirmed that no credit card information was compromised.

Nikkei Inc., a prominent Japanese business news and financial information group, owns the Financial Times and employs over 10,100 people, generating an annual revenue of $2.5 billion (¥393.8 billion).

According to a notice published by Nikkei late last week, hackers accessed a development system within its network using stolen credentials during the early morning hours of October 7. This unauthorized access led to the exposure of personal information stored in the cloud.

Following the breach, Nikkei revoked the compromised credentials and notified the Personal Information Protection Commission on October 11. As of October 16, the company reported no evidence that the accessed information was misused or leaked online.

Nikkei has also stated that there are no signs of system compromise or data tampering resulting from this incident, and the company has not experienced any service outages. Those affected by the breach will receive individual notifications.

Nikkei emphasized, “We are working urgently to establish the extent of the damage and determine the cause, and will implement the necessary measures to strengthen security.”

This incident marks the third cybersecurity breach disclosed by Nikkei in recent weeks. Earlier in October, the company revealed a breach from late July, where hackers compromised an employee’s Google Workspace account, accessing personal information of employees and business partners.

In September, Nikkei announced that threat actors hijacked another employee’s Microsoft 365 account, using it to send spear-phishing emails to the firm’s staff.

BleepingComputer has reached out to Nikkei for further information regarding the latest breach and will provide updates upon receiving a response.

Source: BleepingComputer