Nikkei disclosed a third breach in twelve days on October 16. One stolen credential keeps reaching a store of personal data. I run AliasFleet, an email-alias service: one forwarding address per site, so a leak names its source and the address dies in one click.
This time the credential opened a cloud service Nikkei uses for system development. Attackers got in during the early hours of October 7 and stayed until the morning. About 1.83 million records were caught up in it. About 120,000 of them included an email address. That last number is the one that decides what happens next, because it is the one attackers can actually use.
What Nikkei confirmed
Nikkei disclosed the incident itself on October 16, covered by Nikkei itself, Kyodo News, INTERNET Watch, TBS, Nippon.com, and, the next day, The Japan Times. What is confirmed, and what is not:
| Confirmed | Still unconfirmed |
|---|---|
| Nikkei disclosed the incident itself on October 16 | How the credentials were stolen. Nikkei says only "by some means" |
| Unauthorised access from the early hours to the morning of October 7, 2026 | Which cloud service or vendor was involved. None was named |
| Entry through stolen authentication credentials for a cloud service used for system development | Who the roughly 150,000 people are. Subscribers, contacts, or another group, Nikkei has not said |
| About 1.83 million records compromised. Records, not people | Whether the identifier-only records could be combined with other data to identify people |
| About 150,000 records included at least one of name, email address, address, telephone number, or date of birth | Any attribution to an attacker or group |
| About 120,000 of those records included an email address | Whether the data has surfaced publicly or been traded |
| About 1.68 million records held only identifiers that do not identify an individual on their own | |
| No credit card information included | |
| The stolen credentials have been invalidated | |
| Nikkei reported to Japan's Personal Information Protection Commission on October 11 | |
| No secondary damage from misuse confirmed as of October 16, and no Nikkei system suspension or data tampering confirmed | |
| Nikkei will notify individually the people whose leaked personal data was confirmed |
The credentials are dead now. That closes this door. It says nothing about how the key was copied in the first place, and Nikkei has not said how.
The headline number is the wrong number
Most coverage leads with 1.83 million, and most readers will take it to mean 1.83 million people had their details taken. That is not what happened.
The bulk, about 1.68 million records, holds only identifiers. Nikkei says they do not identify an individual on their own. Nobody outside the company knows what those identifiers actually are, so nobody outside the company can judge how easily they link to a person. Unidentified is not harmless. It is unknown.
Set the headline aside. About 150,000 records carried at least one of name, email, address, phone number, or date of birth. About 120,000 of those carried an email address. That is the phishing list. It is large enough to matter and small enough to be real, which is more than the headline manages.
Three breaches, one open door
Twelve days, three breaches. On October 4 Nikkei said an employee's Microsoft 365 account had been hijacked and used to send about 9,000 phishing emails on September 30, and that a separate Google Workspace intrusion may have exposed names and email addresses of 1,646 employees and business partners. The full account is in our earlier article on the Nikkei data breach. This article covers only the October 16 disclosure.
Different doors. First a hijacked mailbox, now stolen credentials into a development cloud service. Same failure underneath: one set of credentials reached a store of personal data. The fix is not another reminder to be careful. It is making each credential reach less, so one stolen key opens one room instead of the whole building. Nikkei has not said whether it is making that change.
Nikkei is a news organisation, and that makes this breach sharper than the count suggests. Its name lands in inboxes every day. Its readers have years of practice opening its mail and trusting it. The next forged Nikkei email will arrive at people trained to believe it. That is what the 120,000 email addresses buy an attacker: a ready-made audience that already trusts the sender.
If your data was confirmed leaked, a genuine notification is coming… and forgeries will travel beside it. Both will look the same. Open Nikkei's site yourself, typed by you. No link in any email about this breach is worth clicking, including the real one.
The one field you get to control
Nikkei's credential hygiene is Nikkei's problem. Your inbox is yours.
An email alias dedicated to one service, forwarding to your real inbox, changes what a leak like this hands over. If that alias turns up in a breach, you know which service it escaped from. If phishing arrives on it, the alias itself gives the game away: the message claims to come from a sender who never had that address. Kill the alias and the whole channel dies while your real inbox stays clean. The set-up guide takes about two minutes.
An alias does not fix the rest of the file. Your name, address, and phone number still travel with the record, and no email trick changes that. What it does is take the one field you can make expendable and make it expendable. After three breaches in twelve days from one company, that is the only part of the record you get to control.
What to do if Nikkei contacts you
- If you are a confirmed victim, expect a notification… and treat it as unverified until you check it yourself. Nikkei says it will contact confirmed victims individually. Go to Nikkei's site by typing the address, never through a link in an email about the breach. Forged Nikkei mail is the most predictable consequence of this incident.
- If a password you used on a Nikkei service matches one anywhere else, change it there now. Passwords were not listed among the leaked fields. Credential stuffing does not care: it pairs a leaked email with passwords stolen somewhere else.
- Switch on two-factor authentication on your email account. Names, numbers, and dates of birth are what account-recovery flows ask for. Two-factor authentication is the step an attacker cannot talk their way through.
- Once the incident is listed, check Have I Been Pwned, and read how to check if your email was leaked and what Oh no, pwned means first, so the result tells you something useful instead of just scaring you.
- Learn how phishing uses your leaked email, and judge the next message claiming to be from Nikkei by its channel, not its content. A message that reads your own details back to you proves it has the file. It proves nothing about who sent it.
What to watch in the Nikkei investigation
The investigation is still open. The theft method matters most: phishing, a key left in code or logs, or something else entirely, and each answer points at a different fix. Scope may still move, since Nikkei was still examining the range of the intrusion when it disclosed, so 1.83 million is the count confirmed at that point rather than a final figure. And then there is the inbox test. If forged Nikkei mail lands at scale, it will show whether readers can tell a breach notification from a forgery wearing its clothes. By content alone, they cannot. The channel is the only test that works.
