By Hamza Faisal
Japan's biggest financial media group is having a month it would rather forget. Nikkei Inc., the company behind The Nikkei and the Financial Times, has disclosed that hackers used stolen credentials to access a cloud service it uses for system development, exposing about 1.83 million records. It is the publisher's third cybersecurity incident in roughly a month.
The unauthorized access happened in the early hours of October 7, according to the company's disclosure, and the company went public with the incident in a notice late last week.
One login, 1.83 million records
The attackers did not break through a firewall or exploit some exotic zero-day. They simply logged in with credentials that had already been compromised, then walked into Nikkei's development environment through a cloud service.
Of the 1.83 million records exposed, the company says the vast majority — about 1.68 million — contained identifiers that cannot independently identify individuals. The remaining 150,000 records are the ones that matter: full names, email addresses, physical addresses, telephone numbers and dates of birth. Email addresses appeared in roughly 120,000 records.
The one piece of good news is the kind of data that was not there. Nikkei says no credit card information was stored in the affected environment, and it will notify each affected individual directly.
Contained, so far
Nikkei says it revoked the abused credentials immediately after identifying the breach and has reported the incident to Japan's Personal Information Protection Commission on October 11. As of October 16, the company said it had found no evidence that the accessed information had been misused or published online, and no signs of system compromise, data tampering or service disruption.
Still, the incident is embarrassing precisely because of its simplicity. Stolen credentials remain the workhorse of modern intrusions — attackers reuse them because they keep working, and development environments tend to hold rich troves of data with weaker guardrails than production systems.
A rough month for Japan's data
Nikkei is not alone. October has been a punishing month for Japanese companies: delivery giant Yamato Transport put the number at 5.31 million compromised records from its pay-later service, and disclosures have been stacking up across retailers, transport firms and cloud providers all month.
For Nikkei, the timing stings. The announcement comes less than a year after the company disclosed a separate breach stemming from a hacked Slack account. Three incidents in a month — and a reminder that in 2026, the most dangerous vulnerability in the stack is still a password someone left lying around.
Hamza Faisal covers AI, startups and security for Paktechstan.
