[medium] Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud

Thu, 22 Oct 2026 23:38:20 GMT

Japanese media group Nikkei Inc. (owner of the Financial Times) says attackers used stolen credentials, obtained by unknown means, to access a cloud service it uses for system development in the early hours to morning of October 7, 2026, and personal information stored there leaked. As of October 16, about 1.83 million items had leaked: about 150,000 contain a name, email address, postal address, phone number or date of birth (about 120,000 include an email address), and about 1.68 million contain only information that cannot identify a person. No credit card data. Nikkei disabled the credentials, reported to Japan's Personal Information Protection Commission on October 11 and says it found no misuse so far. On October 21 Nikkei BP said about 800,000 of the leaked items belong to users of its services. BleepingComputer counts this as Nikkei's third disclosed incident in about a month.

Status: live · Patch: patched · Fixed in: Nikkei disabled the stolen credentials used for the access; scope review ongoing

Latest updates:

2026-10-21: Nikkei BP says about 800,000 of the leaked items belong to users of its services (about 50,000 with name, email, address, phone or date of birth; about 750,000 identifiers only). (source)
2026-10-16: Nikkei discloses the breach: about 1.83 million items leaked, about 150,000 with identifying details, no credit card data, no misuse or system outage found. It will contact affected people individually. (source)
2026-10-11: Nikkei reports the incident to Japan's Personal Information Protection Commission. (source)

pwn.watch: Nikkei incident updates

[medium] Nikkei breach: stolen credentials expose 1.83M personal-information records from a development cloud