Nikkei has disclosed its third data breach in about a month. Attackers used stolen credentials to reach a development system in its network in the early hours of October 7, exposing about 1.83 million records stored in the cloud. BleepingComputer reported the disclosure on October 19.
Of the 1.83 million records, about 150,000 contained at least one of the following: full name, email address, physical address, phone number or date of birth. Email addresses appeared in 120,000 of those. The remaining 1.68 million records held no identifying information. Nikkei says no credit card data was exposed.
Nikkei revoked the abused credentials and notified Japan's Personal Information Protection Commission on October 11. As of October 16 it had found no evidence of misuse or of the data appearing online, and no sign of system compromise, data tampering or service outages. It has not said how the credentials were stolen and is still working out the scope. Affected individuals will be notified directly.
The earlier incidents point to the same weak spot: employee identities. In late July, attackers compromised an employee's Google Workspace account and accessed personal data on employees and business partners. In September, Nikkei said a hijacked employee Microsoft 365 account was used to send spear-phishing emails to staff, as reported by BleepingComputer.
Why it matters. Development and staging environments often hold copies of production-grade personal data with weaker controls than production. Valid credentials make the access look like normal logins, so signature-based detection rarely fires.
Mitigation. Rotate and scope credentials for development and cloud build systems. Enforce phishing-resistant MFA on cloud consoles and developer accounts. Keep production personal data out of development environments, or mask it. Alert on logins from new locations or infrastructure to dev systems, and review access logs back to early October for any shared credentials.
