Nikkei Says 1.83 Million Data Items Leaked

Nikkei Inc., the Japanese media group, says someone used stolen credentials to get into a cloud service it uses for system development, and that about 1.83 million items of personal information were leaked. Most of those items cannot identify an individual on their own, but about 150,000 contain details such as names and email addresses. Nikkei says it is still reviewing how far the breach goes.

What Nikkei disclosed

In an announcement on 16 October, Nikkei said: “A cloud service used by Nikkei Inc. for system development was accessed without authorization, and as of October 16, approximately 1.83 million items of personal information had been leaked.”

It broke the figure down:

“About 150,000 items contained one or more of the following: name, email address, postal address, phone number or date of birth.”
“Of these, about 120,000 included an email address.”
“About 1.68 million items contained only information that cannot identify an individual.”

Nikkei added: “No credit card information is included in any of the leaked information.”

How it happened

According to Nikkei, “the credentials used to access the cloud service were stolen by unknown means.” It says the unauthorised access “took place from the early hours to the morning of October 7”, and that personal information stored in the cloud was taken. Nikkei has since disabled the credentials used. It has not named the cloud provider or said how the credentials were stolen.

Nikkei says it reported the incident to Japan’s Personal Information Protection Commission on 11 October, four days after the access and five days before announcing it publicly. “We are now reviewing the scope of the breach and the personal information that was leaked,” the company said, so the figures could change.

Damage so far

As of 16 October, Nikkei says it has “found no secondary damage, such as misuse of the leaked personal information”, and “no other problems, such as Nikkei system outages or data tampering.” It says it will contact each person whose information is confirmed to have leaked, is investigating the cause, and will make the necessary security improvements. Nikkei has set up an online inquiry form for people affected.

This disclosure is about a development cloud service accessed on 7 October. Nikkei’s notice does not link it to any other incident.

What Nikkei has not said

Several important details are missing from the notice. Nikkei has not said which cloud provider or service was involved, what the development system was for, or whose data was stored in it, for example subscribers, event attendees or business contacts. It has not said how many individual people the 1.83 million items represent, or how the credentials were stolen. It has not said whether the attacker could reach anything beyond the development cloud, although it reports no outages or data tampering in its own systems. Nikkei says it is still working to “assess the extent of the damage and find the cause”, so these answers may come in a later update.

Why it matters

The case highlights a common weak point: development and test environments that hold real personal data, protected only by credentials that can be stolen. Japanese companies have disclosed a run of large data leaks this year, including Burger King Japan’s app members and the community platform Commune. In Nikkei’s case, about 120,000 email addresses were exposed, which raises the risk of targeted phishing for the people affected.

What this means

About 1.83 million items leaked, but Nikkei says only about 150,000 contain identifying details such as names, addresses or email addresses. No card data was involved.
The attackers used valid credentials stolen “by unknown means”. The cause and the full scope are still under investigation.
People who get a notice from Nikkei should be wary of phishing emails that use their leaked details.