# Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud · pwn.watch > Japanese media group Nikkei Inc. (owner of the Financial Times) says attackers used stolen credentials, obtained by unknown means, to access a cloud service it uses for system development in the early hours to morning of October 7, 2026, and personal information stored there leaked. As of October 16, about 1.83 million items had leaked: about 150,000 contain a name, email address, postal address, phone number or date of birth (about 120,000 include an email address), and about 1.68 million contain only information that cannot identify a person. No credit card data. Nikkei disabled the credentials, reported to Japan's Personal Information Protection Commission on October 11 and says it found no misuse so far. On October 21 Nikkei BP said about 800,000 of the leaked items belong to users of its services. BleepingComputer counts this as Nikkei's third disclosed incident in about a month. Page: https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026 · generated 2026-10-23T03:54:42.456Z ## Status - Severity: medium · status: live · patch: patched - Product: Nikkei Inc. development cloud service (customer data of Nikkei and group services such as Nikkei BP) - Started: 2026-10-07 - Affected: Personal information stored in a Nikkei cloud service used for system development (about 1.83 million items); Nikkei BP service users: about 800,000 items (about 50,000 with name, email, address, phone or date of birth) - Fixed in: Nikkei disabled the stolen credentials used for the access; scope review ongoing ## Follow this incident - RSS (one item per update): https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026.json - This file: https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-10-21: Nikkei BP says about 800,000 of the leaked items belong to users of its services (about 50,000 with name, email, address, phone or date of birth; about 750,000 identifiers only). (https://www.nikkeibp.co.jp/atcl/newsrelease/corp/20261021_2/) - 2026-10-16: Nikkei discloses the breach: about 1.83 million items leaked, about 150,000 with identifying details, no credit card data, no misuse or system outage found. It will contact affected people individually. (https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html) - 2026-10-11: Nikkei reports the incident to Japan's Personal Information Protection Commission. (https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html) - 2026-10-07: Attackers use stolen credentials to access a Nikkei cloud service used for system development, from the early hours to the morning, and personal information stored there leaks. (https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html) ## Fix brief # Security brief: Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud Source: https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026 · status: live · severity: medium · updated Oct 23, 2026, 03:53 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is Japanese media group Nikkei Inc. (owner of the Financial Times) says attackers used stolen credentials, obtained by unknown means, to access a cloud service it uses for system development in the early hours to morning of October 7, 2026, and personal information stored there leaked. As of October 16, about 1.83 million items had leaked: about 150,000 contain a name, email address, postal address, phone number or date of birth (about 120,000 include an email address), and about 1.68 million contain only information that cannot identify a person. No credit card data. Nikkei disabled the credentials, reported to Japan's Personal Information Protection Commission on October 11 and says it found no misuse so far. On October 21 Nikkei BP said about 800,000 of the leaked items belong to users of its services. BleepingComputer counts this as Nikkei's third disclosed incident in about a month. Severity detail: 1.83M records, about 150K with name/email/address/phone/date of birth; no credit card data; no misuse found as of Oct 16 - Product: Nikkei Inc. development cloud service (customer data of Nikkei and group services such as Nikkei BP) ## Affected versions - Personal information stored in a Nikkei cloud service used for system development (about 1.83 million items) - Nikkei BP service users: about 800,000 items (about 50,000 with name, email, address, phone or date of birth) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Nikkei disabled the stolen credentials used for the access; scope review ongoing After upgrading, re-run the checks above and redeploy/restart the affected services. ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 21, 2026: Nikkei BP says about 800,000 of the leaked items belong to users of its services (about 50,000 with name, email, address, phone or date of birth; about 750,000 identifiers only). - Oct 16, 2026: Nikkei discloses the breach: about 1.83 million items leaked, about 150,000 with identifying details, no credit card data, no misuse or system outage found. It will contact affected people individually. - Oct 11, 2026: Nikkei reports the incident to Japan's Personal Information Protection Commission. - Oct 7, 2026: Attackers use stolen credentials to access a Nikkei cloud service used for system development, from the early hours to the morning, and personal information stored there leaks. ## Advisories - [Personal Information Leak Due to Unauthorized Access](https://www.nikkei.co.jp/nikkeiinfo/en/news/announcements/1562.html) (Nikkei Inc.) - [【重要なお知らせ】日本経済新聞社への不正アクセスに伴う当社サービス利用者の個人情報の漏えいについて](https://www.nikkeibp.co.jp/atcl/newsrelease/corp/20261021_2/) (Nikkei BP) ## Write-ups & news - [Nikkei discloses third data breach in a month, 1.8M records exposed](https://www.bleepingcomputer.com/news/security/nikkei-discloses-third-data-breach-in-a-month-18m-records-exposed/) - [Hackers Steal 1.8 Million Records From Nikkei](https://www.securityweek.com/hackers-steal-1-8-million-records-from-nikkei/) - [Nikkei data breach affected over 1.8 million records](https://securityaffairs.com/201369/data-breach/nikkei-data-breach-affected-over-1-8-million-records.html) ## Caveats How the credentials were stolen has not been disclosed. Counts are Nikkei's as of Oct 16 and may change as its scope review continues. The Nikkei BP figure (Oct 21) is part of the 1.83M total, not in addition to it. --- Machine-readable: https://pwn.watch/i/nikkei-cloud-dev-credentials-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.