Nikkei discloses third breach in a month

Nikkei Inc. said a fresh breach had exposed 1.83 million personal information records. It said most of the records did not contain identifiers, although some did include names, email addresses, physical addresses, telephone numbers and birth dates.

The company said 150,000 records contained at least one of those details, and that email addresses appeared in 120,000 records. It also said no credit card information had been exposed.

According to a notice it published late last week, attackers used stolen login details to enter a development system in the early hours of 7 October. The access affected information the company stored in the cloud.

Nikkei said it withdrew the compromised credentials and notified the Personal Information Protection Commission on 11 October. It said that, as of 16 October, it had found no sign that the information had been misused or leaked online, and no sign of system compromise, data tampering or service outages.

The company said people affected by the breach would be contacted individually. It also said this was the third cybersecurity incident it had disclosed recently, after a late-July breach through a Google Workspace account and a September incident involving a Microsoft 365 account.