Short answer
Nikkei said an unknown party used stolen credentials on the morning of 7 October 2026 to reach a cloud service used for system development, and about 1.83 million personal data records leaked. It is the third incident the publisher has disclosed in roughly a month.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Nikkei |
|---|---|
| Incident type | Data breach |
| Status | Confirmed by the organization |
| Sector | Media and publishing |
| Country | Japan |
| Detected | 2026-10-07 |
| Disclosed | 2026-10-16 |
| People or records affected | About 1.83 million records, of which about 150,000 contained at least one personal identifier |
What data was exposed
- About 150,000 records with at least one of: name, email address, postal address, phone number or date of birth
- Email addresses in about 120,000 of those records
- About 1.68 million records that held only identifiers that cannot identify a person on their own
- No credit card information, according to Nikkei
What happened
Nikkei, the Japanese business news and information group, published a notice on 16 October 2026 saying a cloud service it uses for system development had been accessed without authorization. The access took place in the early morning to morning of 7 October. According to the notice, credentials used to reach the service were stolen by a method that is still unknown, and personal data stored in the cloud was leaked.
BleepingComputer reported the notice on 19 October and described it as the third incident Nikkei had disclosed in about a month. The publisher has about 10,100 employees.
What was exposed
Nikkei counts about 1.83 million leaked records. The notice breaks them down as follows:
- About 150,000 records contained at least one of a name, email address, postal address, phone number or date of birth. About 120,000 of those included an email address.
- About 1.68 million records contained only identifiers that cannot identify a person on their own.
- No credit card information was included.
The size of the headline number is therefore misleading. The count of records that can point to a named person is far smaller than 1.83 million, though Nikkei has not said how many unique individuals that represents.
What Nikkei has done
Nikkei says it invalidated the credentials used in the attack and reported the incident to Japan’s Personal Information Protection Commission on 11 October. As of 16 October it had confirmed no misuse of the data, no system shutdown and no tampering. It says it is working to establish the extent of the damage and the cause, and will send individual notices to people whose data was confirmed leaked. The notice carries two later updates about a PHP vulnerability: on 23 October Nikkei changed its inquiry form, and on 26 October it said maintenance was complete and the standard form was restored.
The earlier incidents
Nikkei’s October disclosure followed two employee account compromises. BleepingComputer reported that attackers took over a staff Google Workspace account in late July and reached personal information on employees and business partners, and that another employee’s Microsoft 365 account was hijacked and used to send spear-phishing emails to colleagues. Those are separate events from the 7 October cloud access, and Nikkei has not said they are connected.
Why this matters for scams
A leaked name plus email, address or date of birth is enough to make a scam message look personal. Be careful with anything that mentions Nikkei, a subscription, a refund or a “verification” step, and ignore deadlines that push you to act at once.
Read our data breach checklist and our guide to phishing messages. For another large Japanese incident this fall, see the Times Car Park24 breach.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Phishing emails or texts posing as Nikkei, its subscription service or a Japanese regulator that ask you to confirm account details.
- Messages that quote your name, address or date of birth to look legitimate and push you to click a link or call a number.
- Spear-phishing sent from genuine-looking Nikkei staff addresses, because staff accounts were also compromised earlier in this series of incidents.
What to do if you are affected
- 01Treat unexpected messages that mention Nikkei as suspicious and open the service by typing the address yourself.
- 02Wait for Nikkei's individual notice before acting on any email that claims you were affected, and do not reply to it with personal details.
- 03If you reuse your Nikkei password elsewhere, change it and turn on two-step verification.
- 04Do not open attachments or follow links in messages that cite the breach.
- 05Report fraud you encounter to your local consumer or police authority.
Frequently asked questions
How many people were affected by the Nikkei breach?
Nikkei reported about 1.83 million leaked records. Only about 150,000 of them held a name, email address, postal address, phone number or date of birth, and about 120,000 of those included an email address. The other 1.68 million held only identifiers that cannot identify a person alone.
Was payment card data stolen?
Nikkei says no credit card information was included in the leaked records.
How did the attacker get in?
Nikkei says credentials for the cloud service were stolen by a method it has not identified. It has invalidated the credentials that were used.
Has the leaked data been misused?
As of 16 October, Nikkei said it had confirmed no secondary harm such as misuse of the data, no system shutdown and no data tampering. It will notify individuals whose data was confirmed leaked.
Sources
- Notice on unauthorized access and personal data leak, Nikkei, 2026-10-16
- Nikkei discloses third data breach in a month, 1.8M records exposed, BleepingComputer, 2026-10-19
- Nikkei discloses breaches of employees' Microsoft, Google email accounts, BleepingComputer, 2026-10-06
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.