Cybersecurity

Nikkei Discloses Employee Email and Phishing Breaches

Japanese publishing giant Nikkei has disclosed that unknown threat actors recently breached two employee email accounts, using one of the compromised accounts to launch thousands of phishing emails.

Radwan AbdulhadiEditor and technology writer

Published: October 6, 2026 · Updated: October 6, 2026 · 3 min read

Nikkei Discloses Employee Email and Phishing Breaches — Image: BleepingComputer

Google Workspace Account Breach Exposes Personal Data

Japanese publishing giant Nikkei disclosed over the weekend that unknown attackers recently breached two employee email accounts, with the first incident affecting a Google Workspace account in late July. According to a <a href="https://www.nikkei.co.jp/nikkeiinfo/news/information/1547.html">Sunday statement</a>, this initial breach exposed the personal information of employees and business partners.

Google notified Nikkei about the breach in early August, prompting the company to change the compromised account's password. Although the incident potentially exposed the names and email addresses of 1,646 individuals, the media corporation stated that the affected data did not include information concerning readers or interviewees.

Microsoft 365 Account Used to Send Phishing Emails

In a more recent security event, threat actors successfully <a href="https://www.nikkei.co.jp/nikkeiinfo/news/information/1554.html">accessed another employee's Microsoft 365 account</a> during September. The attackers utilized this account to dispatch 9,000 phishing emails directed at Nikkei staff members as well as external interviewees.

The media giant explained that on September 30th, emails featuring links to malicious websites were distributed to internal staff and contacts. Following the discovery, Nikkei updated its passwords and confirmed that no unauthorized logins have taken place since. The company has also reached out individually to recipients to request the deletion of the suspicious messages and warned affected parties to remain vigilant against further impersonation attempts.

Attribution and Broader Context of Past Incidents

As of the disclosure, Nikkei has not attributed the attacks to any specific threat actor or hacking group, nor has it confirmed whether the Google and Microsoft account breaches are connected. These incidents follow a string of prior security challenges reported by the corporation over the past several years.

Among previous events, the company previously <a href="https://www.bleepingcomputer.com/news/security/media-giant-nikkei-reports-data-breach-impacting-17-000-people/">revealed that its Slack messaging platform had been breached</a>, impacting over 17,000 employees and business partners. Furthermore, Nikkei's Singapore unit <a href="https://www.bleepingcomputer.com/news/security/media-giant-nikkeis-asian-unit-hit-by-ransomware-attack/">was hit by a ransomware attack</a> in May 2022, and back in September 2019, <a href="https://www.bleepingcomputer.com/news/security/media-giant-nikkei-loses-29-million-to-bec-scammers/">Nikkei lost approximately $29 million</a> in a business email compromise attack targeting a Nikkei America employee.

About Nikkei Operations

Nikkei operates as one of the world's largest media corporations, owning major publications including The Nikkei—the world's largest financial newspaper—and the Financial Times. The organization oversees more than 40 affiliated companies spanning publishing, broadcasting, events, database services, and index businesses, supporting over 3.7 million digital paid subscriptions alongside global editorial bureaus and journalists.