Attackers used hijacked Nikkei accounts to send 9,000 phishing emails to staff and sources
Nikkei said attackers used hijacked staff Microsoft 365 accounts to send about 9,000 malicious-link emails on September 30, many to outside sources. The company believes recipients' names and addresses were exposed and expects more mail impersonating its staff.
The Watch · Security desk
What happened
- The emails came from genuine Nikkei accounts, so the sender address alone gave recipients little reason for suspicion.
- Nikkei has changed the affected passwords and says it has detected no further unauthorized logins since.
- In a separate breach, outsiders had been logged in to employee Google Workspace accounts since late July, possibly exposing data on 1,646 employees and business partners.
Why it matters
- Who's exposed exposure Nikkei's statement that no reader or source data leaked applies only to the Workspace breach, so it does not cover the outside sources who received the Microsoft 365 mail.
- What's now possible capability An attacker holding correspondent names and parts of real messages can write follow-up lures that match conversations those contacts actually had with Nikkei staff.
- Who's exposed exposure If October 4 was Nikkei's first filing on the Workspace breach, it came about two months after discovery, under a rule that expects a preliminary report within three to five days.
Next story · Product · Oct 8
Google Cloud's Gemini agent carries one memory into Microsoft 365, Slack and the command lineConfirmed23 publishers
At a newspaper, the people who have corresponded with employees include sources [2]. The report says numerous external sources and contacts received the September 30 mail [2]. The content of some messages is also believed to have been exposed, along with recipients' names and addresses [5]. Nikkei has contacted each recipient individually and asked them to delete the emails [7].
Nikkei warned that more spoofed emails posing as Nikkei or group company staff may follow. It asked anyone who gets a suspicious message to report it through its inquiry form [14]. "We ask everyone to remain vigilant against suspicious emails while we continue our investigation," the company said in a statement [15]. Nikkei has not said how the Microsoft 365 accounts were taken or whether the two intrusions are linked, and the report describes the Workspace breach as separate [8].
Google found the Workspace access, and Nikkei did not [9]. The intrusion started in late July and Google's notice came in early August [8][9]. That is a window of under a month [18]. The two-month gap in this incident comes after discovery. About two months passed between Google's notice and the October 4 announcement [19].
Japan's Act on the Protection of Personal Information makes reporting mandatory for breaches affecting more than 1,000 people [16]. At 1,646 people, the Workspace incident is over that threshold [20]. A preliminary report is due within roughly three to five days of discovery. The final report is due within 30 days, or 60 if the breach was carried out for malicious purposes [17]. The Cyber Express timeline puts Nikkei's report to the Personal Information Protection Commission on October 4, the same day as the public announcement [12]. Nikkei says it is still investigating the full scope and the number of personal records involved [13].
What to watch
- Nikkei's final reports to the Personal Information Protection Commission, due 30 days after discovery or 60 if the breach is judged malicious, and any revision to the 1,646 count.
- Any finding on how the Microsoft 365 accounts were taken and whether that intrusion connects to the Google Workspace access.
- Reports of further spoofed mail posing as Nikkei or group company staff, the follow-on the company has warned about.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence65
Perspective Coverage
6 publishers- Builder
- Builder 19%
- Operator
- Operator 60%
- Investor
- Investor 21%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
On September 30, attackers used the hijacked Microsoft 365 accounts to send about 9,000 emails containing links to malicious websites.
- [2]
Recipients of the September 30 emails included Nikkei staff as well as numerous external sources and contacts who had previously corresponded with employees.
- [3]
Because the messages came from Nikkei's genuine accounts, the sender address alone gave recipients little reason for suspicion.
- [4]
Nihon Keizai Shimbun (Nikkei) disclosed on October 4 that employees' Microsoft 365 business software accounts had been compromised.
- [5]
The attack is believed to have exposed recipients' names and email addresses, along with the content of some messages.
- [6]
Nikkei has changed the affected passwords and says it has detected no further unauthorized logins.
- [7]
Nikkei contacted each recipient individually and asked them to delete the emails.
- [8]
In a separate incident, outsiders logged in to the Google Workspace cloud accounts employees use for work; since late July, names, email addresses and other information belonging to 1,646 employees and business partners may have leaked.
- [9]
Nikkei learned of the Google Workspace access in early August, when Google notified the company.
- [10]
According to Nikkei, the data leaked in the Google Workspace incident did not include information on readers or sources, and no secondary damage has been confirmed.
- [11]
Nikkei has reported both incidents to Japan's Personal Information Protection Commission.
- [12]
The Cyber Express timeline lists October 4, 2026 as the date Nikkei announced the incidents publicly and reported them to the Personal Information Protection Commission.
- [13]
Nikkei is still investigating the full scope of the breach and the number of personal records involved.
- [14]
Nikkei warned that spoofed emails posing as Nikkei or group company staff may increase and asked anyone receiving a suspicious message to contact it through its inquiry form.
- [15]
We ask everyone to remain vigilant against suspicious emails while we continue our investigation.
- [16]
Under Japan's Act on the Protection of Personal Information, breaches affecting more than 1,000 people are subject to mandatory reporting.
- [17]
A preliminary report is due within roughly three to five days of discovery; a final report is due within 30 days, or within 60 days if the breach was carried out for malicious purposes.
- [18]
Google's notice came less than a month after the Workspace access began.
- [19]
About two months passed between Google's early-August notice and Nikkei's October 4 announcement and Commission report.
- [20]
The Workspace incident's 1,646 affected people exceed the 1,000-person mandatory reporting threshold.
Sources
6 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comNikkei discloses breaches of employees’ Microsoft, Google email accounts
2 articles · October 6, 2026
- dev.toNikkei Confirms Breach After 9,000 Phishing Emails Sent From Hacked Employee Account
2 articles · October 6, 2026
- infosecurity-magazine.comNikkei Discloses Two Employee Cloud Account Compromises
1 article · October 6, 2026
- scworld.comNikkei discloses two employee account compromises, one used for phishing
1 article · October 7, 2026
- thecyberexpress.comNikkei Cyberattack Hijacks Employee Accounts, Sends 9,000 Spoofed Emails
1 article · October 5, 2026
- therecord.mediaJapanese media group Nikkei discloses cyberattack targeting journalistic sources
1 article · October 5, 2026
Topics and entities
Topics
- Phishing
- Japan data protection
- Account Takeover
Entities
- Google Workspace
- Act on the Protection of Personal Information
- Personal Information Protection Commission
- Microsoft 365