Nikkei discloses breach of development system exposing 1.83 million records

On 16 October 2026, Nikkei — the Tokyo-based media group that publishes the Nihon Keizai Shimbun and owns the Financial Times — disclosed a data breach affecting roughly 1.83 million personal records, its third publicly acknowledged security incident in about a month. The company said an unauthorised party had used stolen authentication credentials to access a cloud-based system used for development, with the intrusion dated to the early morning of 7 October 2026. The method by which the credentials were obtained has not been determined.

Of the exposed records, Nikkei estimated that about 150,000 contained at least one identifying field — a combination of names, email addresses, physical addresses, phone numbers, and dates of birth — with email addresses appearing in roughly 120,000. The remaining 1.68 million records held data that could not identify a person on its own. The company said no credit card information was involved and that, as of 16 October, it had found no evidence the data had been misused or published online.

Response

Nikkei said it revoked the compromised credentials, notified Japan's Personal Information Protection Commission on 11 October, and launched an investigation into the scope and cause of the incident. It found no signs of data tampering or service outages and said it would contact affected individuals directly. Because the affected services and registration periods have not been published, users cannot yet determine from their own history whether they are among those exposed.

A difficult month

The breach followed two earlier incidents the company disclosed in quick succession. In late July, attackers compromised an employee's Google Workspace account and accessed information belonging to employees and business partners; in September, threat actors hijacked a staff member's Microsoft 365 account and used it to send spear-phishing emails internally. Taken together, the three disclosures underscore how repeated credential compromise — rather than any single software flaw — has become the recurring entry point into the organisation.