Nikkei Suffers Second Data Breach in Under a Year, 1.8 Million Records Exposed

Japanese financial media group Nikkei has confirmed a data breach affecting 1.83 million records, after attackers used stolen credentials to access a cloud development environment on the morning of October 7.

The good news, such as it is: roughly 1.68 million of those records contained no personally identifiable information. The less good news: 150,000 records included names, addresses, email addresses, phone numbers, and dates of birth. A further 120,000 contained email addresses alone. No payment card data was taken, the company says.

Nikkei claims it revoked the compromised credentials as soon as the breach was identified, and as of October 16 had seen no evidence of the stolen data being misused. The company has alerted regulators and is continuing its investigation.

The publisher, which owns both The Nikkei and the Financial Times, says operations were not disrupted and no data was tampered with. It has promised to notify affected individuals directly if misuse is confirmed.

What makes this particularly uncomfortable is the timing. This is the second breach Nikkei has disclosed in less than twelve months. The previous incident involved a compromised Slack account. Two breaches in quick succession suggests something more systemic than bad luck, and 'we will take additional security measures if necessary' is not exactly a confidence-inspiring response.

For a company whose entire business is built on the credibility of financial information, getting repeatedly breached via stolen credentials is a reputational problem as much as a security one.