Nikkei, the Japanese media group, has disclosed that hackers using stolen credentials reached personal data in the cloud environment it uses for system development, exposing about 1.83 million records. Roughly 150,000 of those records contained at least one personal detail such as a name, email address, postal address, phone number or date of birth. BleepingComputer described the incident, which began early on Oct. 7, 2026, as Nikkei’s third data breach in a month.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
1.83 million records, 150,000 with personal details
The numbers come from Nikkei’s own notice, dated Oct. 16 and posted on the company’s website. According to the Nikkei notice on the unauthorized access, about 1.83 million personal records were taken in total. About 150,000 of them held at least one of the identifying fields, and about 120,000 of those included an email address. The remaining 1.68 million records, by Nikkei’s description, contained only identifiers that cannot identify a person on their own. The company said no credit card information was involved.
The split matters for anyone trying to gauge the harm. Headline totals of this size tend to be read as 1.83 million people, but Nikkei counts records, and the great majority of them are the low-risk kind. The roughly 150,000 identifying records are the ones that could be used for phishing or impersonation, and the 120,000 with email addresses are the most directly reachable by a scammer. Nikkei’s notice also apologized for the trouble and concern caused to the people involved, and it directed inquiries to an online form on its support site, with media questions routed to its Public Relations Office by email. Because the company says it will notify confirmed victims individually, a person whose record is among the 150,000 would hear from Nikkei directly rather than learn of it from the published totals.
Stolen credentials and a development system
The company said credentials for the cloud service it uses for system development were stolen by a method it has not specified, and an attacker then used them to reach personal data stored there. In the BleepingComputer report on the third breach, the intrusion began early on Oct. 7 and ran into the morning. Nikkei revoked the abused credentials and notified Japan’s Personal Information Protection Commission, the government body connected to the country’s Act on the Protection of Personal Information, on Oct. 11.
Nikkei said it is “working urgently to establish the extent of the damage and determine the cause,” and that people confirmed to be affected will be notified individually. As of Oct. 16 it reported no evidence of secondary harm, such as misuse of the data or its appearance online, and no system outages or data tampering. BleepingComputer said it had contacted Nikkei for more detail and would update its article if the company replied.
No attacker has claimed the breach in the sources reviewed, and the company has not said how the credentials were obtained.
Three incidents in quick succession
The word “third” refers to a run of incidents, though the incidents themselves are spread across several months. BleepingComputer’s account lists the earlier two. The first was the compromise of an employee’s Google Workspace account in late July 2026, exposing personal information of employees and business partners; BleepingComputer covered it in an earlier report on Nikkei’s email account breaches. The second was the hijack of an employee’s Microsoft 365 account in September.
That second incident is documented in a separate Nikkei notice published Oct. 4. It says emails directing recipients to a malicious site were sent on Sept. 30 to internal contacts and to news sources that had exchanged messages with Nikkei employees. About 9,000 spoofed emails went out from the account, and the recipients’ email addresses and names were likely leaked, along with parts of some emails. Nikkei changed the employee’s password, contacted affected recipients individually and asked them to delete the messages.
The dates show why the “month” framing is a description of the disclosures rather than of the intrusions. The July incident was reported earlier in October, the September account hijack was disclosed on Oct. 4, and the development-system breach was disclosed on Oct. 16, so the three notices landed within weeks of each other even though the underlying events began in July, on Sept. 30 and on Oct. 7.
The pattern in the notices is also telling. Each involved a stolen or hijacked login rather than a flaw in Nikkei’s published software: a Workspace account, a Microsoft 365 account and credentials for a cloud development service. Nikkei has said it plans to strengthen its security measures, but its notices do not say what specific controls will change.
The open questions are concrete. Nikkei has not said how many of the 150,000 people it expects to notify individually, how the development-system credentials were first stolen, or whether the three incidents share a common cause. The company’s October 16 figures were described as current as of that day, and its assessment of the scope was still under way.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Tropical Storm Rachel is dumping up to 12 inches on four Mexican states on its way to major hurricane strength
- The FTC says Lens.com doubled the price shoppers saw in Google ads
- Common allergy, bladder and sleep pills tied to sharply higher dementia odds
- NOAA now gives this winter a 75% chance of the strongest El Nino since 1950
