Short answer
Nikkei said on 4 October 2026 that an outside party accessed an employee's Google Workspace account from late July, and that a Microsoft 365 account was used on 30 September to send about 9,000 emails pointing to malicious sites. The company says it has seen no further unauthorized logins and has reported both to Japan's data protection regulator.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Nikkei (employee cloud accounts) |
|---|---|
| Incident type | Account takeover |
| Status | Confirmed by the organization |
| Sector | Media and publishing |
| Country | Japan |
| Detected | 2026-08-01 |
| Disclosed | 2026-10-04 |
| People or records affected | Up to 1,646 people (Google Workspace account) plus the recipients of about 9,000 emails (Microsoft 365 account); a separate Nikkei BP account held 26 names and addresses |
What data was exposed
- Names and email addresses of up to 1,646 employees, business partners and others, from a Google Workspace account accessed from late July 2026
- Names and email addresses of recipients, and possibly parts of some emails, from a Microsoft 365 account used to send about 9,000 emails on 30 September 2026
- 26 names and email addresses at Nikkei BP, per its own release
- Nikkei says reader and news-source information was not in the Google Workspace data
What happened
Nikkei, the Japanese media group, published two notices on 4 October 2026 about employee cloud accounts. They are separate from, and earlier than, the leak of 1.83 million records that Nikkei disclosed later in the month and that we cover in our Nikkei cloud development system post.
The Google Workspace account
In the first notice, Nikkei says an outside party accessed a Google Workspace account that an employee used for work, starting in late July 2026. Google notified Nikkei in early August and the password was changed straight away. Personal data of employees and business partners may have been exposed: names and email addresses of up to 1,646 people. Nikkei says no information about readers or news sources was included, no unauthorized logins have been seen since, and no secondary harm is confirmed. It reported the incident to Japan’s Personal Information Protection Commission.
The Microsoft 365 account
In the second notice, Nikkei says a Microsoft 365 account was used on 30 September to send about 9,000 emails that directed recipients to malicious websites. Recipients included colleagues and external contacts such as news sources. Their names and email addresses, and possibly parts of some emails, may have been exposed. Nikkei says that scope is still under investigation, that it changed the password, has seen no further unauthorized logins and has contacted recipients individually to ask them to delete the emails. It also reported this to the regulator.
Nikkei warned that more suspicious emails posing as Nikkei or group companies may follow.
Nikkei BP
Nikkei BP, a group publisher, issued its own release the same day. Per Infosecurity Magazine’s summary, an employee’s email account was accessed on 30 September after credentials were stolen through a phishing email sent from a Nikkei employee’s address. It lists 26 names and email addresses as potentially exposed.
What is still unknown
Nikkei has not said how either of its own accounts was compromised, who was behind the activity or whether the incidents are linked. Infosecurity Magazine’s introduction attributes the 9,000 emails to the Google account, but both its body text and Nikkei’s notices tie them to the Microsoft 365 account, and we follow the notices.
Why it matters
Mail sent from a genuine employee account is the hardest kind of phishing to spot. It comes from a real address, in a real name, to people who know the sender. Journalists, sources and partners are the natural targets. If you deal with Nikkei, verify unusual requests by another channel before you click or reply.
See our data breach checklist and guide to phishing messages.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- More phishing that appears to come from Nikkei or group-company staff, which Nikkei itself warns may follow.
- Emails carrying a real Nikkei employee's name and a link to a malicious site, which look trustworthy to sources and business partners.
- Fake 'confirm your account' or 'document shared' messages sent to the 1,646 people whose addresses may be exposed.
What to do if you are affected
- 01Delete any email you received from a Nikkei address on or around 30 September 2026 that pointed you to an unfamiliar website, and do not click its links.
- 02If you did click, change that account's password at once from a clean device, and turn on multi-factor authentication.
- 03Treat unexpected messages that appear to come from Nikkei or its group companies as suspicious. Check with the sender by phone or a known address.
- 04Report suspicious messages through Nikkei's inquiry form (support.nikkei.com).
- 05Use unique passwords and a password manager, since stolen addresses are often paired with reused credentials.
Frequently asked questions
What did Nikkei disclose on 4 October 2026?
Two separate notices. An outside party accessed a Nikkei employee's Google Workspace account from late July, and Google alerted Nikkei in early August. Separately, a Microsoft 365 account was used on 30 September to send about 9,000 emails to colleagues and external contacts.
Whose data was exposed?
The Google Workspace account may have exposed names and email addresses of up to 1,646 employees, business partners and others. The Microsoft 365 incident may have exposed recipients' names and email addresses and some email contents, and that scope was still being investigated.
Is this the same as the 1.83 million record leak?
No. These notices date from 4 October. Nikkei separately disclosed on 16 October that stolen credentials reached a cloud development system on 7 October and that 1.83 million records leaked. We cover that one in a separate post.
Do we know who did it?
No. Nikkei has not said how either account was compromised, who was responsible or whether the incidents are connected.
Sources
- Notice on unauthorized access to a Google Workspace account, Nikkei, 2026-10-04
- Notice on unauthorized access to a Microsoft 365 account and spoofed emails, Nikkei, 2026-10-04
- Nikkei Discloses Two Employee Cloud Account Compromises, Infosecurity Magazine, 2026-10-06
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.