Picture someone who spoke to a Nikkei reporter in late September. A few days later, a message lands from that reporter’s real address, in the same thread, asking them to open a document. They open it, because why would they not. On September 30 about 9,000 of those messages went out, and the Nikkei data breach disclosures that followed explain where they came from: attackers were sitting inside an employee’s Microsoft 365 account.
Confirmation: confirmed by the company, in two notices Nikkei published itself.
What happened in the Nikkei data breach
On October 16, Nikkei said a cloud service it uses for system development had been accessed without authorization. The intrusion ran from the early hours to the morning of October 7. Attackers used working credentials that were stolen by means Nikkei has not disclosed. The company disabled those credentials, reported the incident to Japan’s Personal Information Protection Commission on October 11, and said it found no misuse, no outage and no tampering as of the 16th.
Eleven days earlier, on October 5, Nikkei published a different notice. An employee’s Microsoft 365 account had been compromised, and about 9,000 spoofed emails went out from it on September 30, carrying links to malicious sites. Nikkei changed the password and says no further unauthorized logins have appeared since.
Then there is a third one. BleepingComputer reports that an employee’s Google Workspace account was accessible from outside since late July, exposing the names and email addresses of 1,646 people, and that Nikkei found it in early August after Google raised the alarm. That incident does not appear on Nikkei’s English announcements page, so treat it as reported rather than company-confirmed.
Nikkei is not a small target. It owns the Financial Times and The Nikkei, and it counts more than 3.7 million paid digital subscriptions.
What the Nikkei data breach exposed, and what each piece is worth
The October 16 figure most outlets ran was 1.83 million. That number counts items of personal information, not people, and the detail matters. About 1.68 million of those items hold nothing that identifies anybody. The number worth your attention is the roughly 150,000 items that carry at least one of five fields: name, email address, postal address, phone number, date of birth. Around 120,000 of those include an email address.
Here is what each field buys an attacker.
- Email address. The delivery route for everything else, and the thing that lets a
- Name plus email address. A message that opens with your actual name reads as real.
- Postal address and phone number. The same scam by mail or by text, where people are
- Date of birth. A standing identity-verification answer that you cannot change.
stranger write to you as though they already know you.
That is most of the work in a phishing email.
less practiced at being suspicious.
Nikkei says no credit card information was involved. The company also has not named which service these records came from, so you cannot work out from your own account history whether you are in the set. Nikkei says it is contacting affected people individually.
What to do now
Most of this has nothing to do with us.
1. Treat any Nikkei or Financial Times email about the breach as unverified. Then go to the site by typing the address yourself and look for the notice there. Nikkei has warned about messages impersonating it and its subsidiaries. 2. Get a password manager and give every account its own password. Because the October 7 intrusion started with stolen credentials, this is the habit that breaks the chain. 3. Turn on the strongest sign-in each account offers. A passkey where it exists, an authenticator app otherwise, and text messages as a last resort. 4. Watch for the follow-up that knows something true about you. A reply inside a real thread, from a real address, is the shape this attack already took once. 5. Lock your date of birth out of security questions wherever a site lets you choose something else.
How OptMsg changes this exposure
We want to be careful here, because the Nikkei data breach is the case where sender approval does not help. If you approved Nikkei and attackers take over a Nikkei mailbox, that mail arrives in your Inbox like the rest of Nikkei’s mail. Approving a sender says I want this correspondent. It is not scam detection, and we will not describe it as scam detection.
What it does change is the copycat traffic that follows a headline like this one. The lookalike domains, the “security alert” from a sender you have not approved: that mail goes to Trash rather than your Inbox, and auto-deletes after 30 days.
The other half is the account itself. Your OptMsg account has no password, so a password stolen from another site can’t open your inbox. Your email is how most accounts get reset, so keeping that door shut keeps the rest shut with it. Our security first page walks through the approved-sender part.
And here is what the argument does not cover, stated plainly: a compromised device, a live phishing page you type your details into, or somebody holding your unlocked phone. The claim is narrow because a password that does not exist cannot be stolen or reused.
Want an inbox where a breach at a publisher does not turn into a month of convincing email? Create your OptMsg account and take your address while the good ones are free.
Create Your Account
Your Inbox. Your Rules.
Frequently asked questions
Q: What was exposed in the Nikkei data breach? A: About 150,000 items carried at least one of these fields: name, email address, postal address, phone number or date of birth. Roughly 120,000 of those included an email address. Nikkei says the remaining 1.68 million items hold no information that identifies a person, and that no credit card data was involved.
Q: Was 1.83 million people affected? A: No. Nikkei counts items of personal information rather than individuals, and most of those items identify nobody. Treat 150,000 as the figure that carries personal detail.
Q: Am I affected if I subscribe to Nikkei or the Financial Times? A: Nikkei has not said which service the records came from, so you cannot tell from your account history. The company says it is notifying affected people individually.
Q: Why does three incidents in one month matter? A: Because each one gave attackers a working login rather than a software flaw. The September 30 messages went out from a real Nikkei mailbox, which is why they were believable, and it is the pattern to expect next.
Q: Should I change my Nikkei password? A: Nikkei has not asked subscribers to, and it has not said whether passwords were involved. Change it anyway if you reused it anywhere else, and that applies after any breach.
Sources
- Nikkei Inc., “Personal Information Leak Due to Unauthorized Access,” 16 October 2026 — https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html
- Nikkei Inc., “Regarding Information Leaks and the Sending of Suspicious Emails due to a Cyberattack,” 5 October 2026 — https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1555.html
- BleepingComputer, “Nikkei discloses third data breach in a month, 1.8M records exposed,” 19 October 2026 — https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/
- BleepingComputer, “Nikkei discloses breaches of employees’ Microsoft, Google email accounts,” 5 October 2026 — https://www.bleepingcomputer.com/news/security/nikkei-discloses-breaches-of-employees-microsoft-google-email-accounts/
- Jiji Press via nippon.com, “More Japanese Firms Disclose Details of Data Breaches,” 16 October 2026 — https://www.nippon.com/en/news/yjj2026101600745/
Previous in Breach Breakdown: One Stolen Login Exposed Millions of California Students in the ETS Data Breach
Next in Breach Breakdown: Assurance Retraite Data Breach: Your Pension File Is Now Someone Else’s Script
