Japanese media group Nikkei has disclosed two employee email account compromises involving Google Workspace and Microsoft 365. The Nikkei email breaches may have exposed personal information and allowed attackers to distribute 9,000 phishing emails.
The incidents occurred several weeks apart, with unauthorized access in July and September. However, Nikkei has not confirmed a connection between them or identified those responsible.
Attackers Use Microsoft Account to Distribute Phishing Emails
In the more recent incident, attackers accessed an employee’s Microsoft 365 account during September. They subsequently used it to send approximately 9,000 phishing messages on September 30.
The emails contained links to malicious websites and targeted internal staff and interviewees who had communicated with several Nikkei employees.
After discovering the compromise, Nikkei changed passwords and contacted recipients individually, asking them to delete the messages. According to the company, it has detected no further unauthorized logins since those changes.
Meanwhile, Nikkei warned affected individuals to remain alert for additional suspicious messages impersonating the company or its subsidiaries.
Google Workspace Intrusion May Have Exposed 1,646 People’s Details
The earlier incident involved an employee’s Google Workspace account, which attackers accessed in late July.
Google notified Nikkei of the compromise, and the company discovered the breach in early August. It then changed the affected account’s password.
The intrusion may have exposed names and email addresses belonging to 1,646 employees and business partners. However, Nikkei said the affected information did not include reader or interviewee data.
That distinction separates the potential exposure in the Google account incident from the phishing campaign involving Microsoft 365. Interviewees received malicious emails in the later incident, but Nikkei excluded their information from the earlier breach’s affected data.
Connection Between the Nikkei Email Breaches Remains Unclear
Nikkei has not publicly linked either intrusion to a particular attacker or hacking group. It also has not explained whether the same individuals compromised both accounts.
Consequently, the available information does not establish that the incidents formed part of a coordinated campaign.
The disclosures concern employee accounts hosted on the two services. They do not establish a breach of Google’s or Microsoft’s underlying infrastructure.
Previous Incidents Include Slack Breach and Email Fraud
The latest compromises add to several security incidents that Nikkei has disclosed in recent years.
In 2025, the company reported a breach of its Slack environment affecting more than 17,000 employees and business partners.
Previously, a May 2022 ransomware attack hit Nikkei’s Singapore subsidiary. The affected server likely contained customer information, according to the company’s disclosure.
Nikkei also lost approximately $29 million in a September 2019 business email compromise attack targeting an employee at Nikkei America.
The group operates publishing, broadcasting, events and data businesses through more than 40 affiliated companies.
0 responses to “Nikkei Email Breaches Expose Personal Data and Trigger 9,000 Phishing Messages”