NIKKEI disclosed a data breach affecting more than 1.8 million records after attackers used stolen credentials to access a cloud service used for system development. The incident began on the morning of 7 October, when the intruders gained entry with previously stolen login details. Nikkei published an official data breach notice stating that by 16 October around 1.83 million items of personal information had been leaked.
Of these, about 150,000 items contained one or more identifiers such as name, email address, postal address, phone number, or date of birth, while roughly 1.68 million items contained information that could not identify an individual. The notice confirmed that no credit card information was included in the leaked data.
Nikkei reported the breach to Japan’s Personal Information Protection Commission on 11 October and said it was continuing to investigate the scope of the incident and what personal information had been stolen. The company stated that it had since blocked the stolen credentials and, as of 16 October, found no signs of further damage, such as data misuse, system outages, or changes to its data.
Nikkei apologised to those affected and said it would contact anyone whose personal information was exposed while it investigates how the breach occurred and plans to strengthen its security. The report notes that previous incidents in 2022 and 2025 involved Nikkei, but those are separate from this October breach.