Nikkei (Japanese media group, owner of the Financial Times) says stolen credentials were used on 7 Oct to get into a cloud service it uses for system development, leaking about 1.83 million personal-information items, about 150,000 of them with names, emails, addresses, phone numbers or birth dates; its third disclosed incident in about a month
Nikkei Inc. said on 16 October 2026 that a cloud service it uses for system development was accessed without authorisation and that, as of 16 October, about 1.83 million items of personal information had leaked. About 150,000 items contained at least one of name, email address, postal address, phone number or date of birth, and about 120,000 of those included an email address. The other roughly 1.68 million items held only identifiers that cannot identify a person on their own. No credit card information was involved. Nikkei says the credentials used were stolen by unknown means, the access took place from the early hours to the morning of 7 October, and personal information stored in the cloud was taken. It has disabled the credentials, reported the incident to Japan's Personal Information Protection Commission on 11 October, and will contact each person whose information is confirmed to have leaked. As of 16 October it had found no misuse of the data, no system outages and no data tampering. Nikkei has not named the cloud service or an attacker. This is a separate incident from the hijacked Microsoft 365 account that sent about 9,000 phishing emails on 30 September and the earlier Google Workspace account compromise, both covered on this desk (/n/nikkei-m365-email-phish-breach-20261004); Nikkei has not said whether they are connected. Primary: Nikkei Inc. notice (English and Japanese, 16 Oct); wire: BleepingComputer (19 Oct).
- Product
- Cloud service used by Nikkei Inc. for system development (not named)
- Versions
- n/a — credential-based intrusion (7 Oct 2026); no CVE or product flaw identified
- Exploited in Australia?
- unknown
- Patch to
- Treat development and test environments that hold copies of real customer data as production: mask or synthesise test data, and keep secrets for dev cloud services in a vault with short-lived credentials. Require phishing-resistant MFA and conditional access on developer and CI/CD cloud accounts, alert on bulk reads from dev storage, and rotate keys when staff or contractors leave. Anyone who has dealt with Nikkei should watch for phishing that uses leaked contact details. Practitioner page: /knowledge/asd-essentials-cloud.
Primary: Nikkei Inc. — Personal Information Leak Due to Unauthorized Access (16 Oct 2026) · Vendor: Nikkei Inc. — 不正アクセスによる個人情報漏洩について (Japanese notice, 16 Oct 2026) · BleepingComputer — Nikkei discloses third data breach in a month, 1.8M records exposed (19 Oct 2026)