Nikkei Inc. reported a new data breach, its third in about a month, that exposed 1.83 million records of personal information.
The Japanese giant says subsets of the data contained personally identifiable information and other sensitive details, but most datasets contained no identifying information.
The company said 150,000 records contained at least one of the following data types: full names, email addresses, physical addresses, phone numbers and dates of birth. Email addresses appeared in 120,000 records.
The remaining 1.68 million records contained no identifiers, the company said, and no credit card information was disclosed.
Nikkei Inc. is a major Japanese business news and financial information company and owner of the Financial Times, the country’s largest business-oriented media company.
The company employs over 10,100 people and has annual revenue of $2.5 billion (¥393.8 billion).
According to a release from Nikkei late last week, hackers used stolen credentials to access a development system within its network in the early hours of Oct. 7.
The unauthorized access exposed personal information that the company had stored in the cloud.
Nikkei revoked the misused credentials and notified the Personal Information Protection Commission on October 11.
The company is currently investigating the extent of the breach and noted that as of October 16, it had no evidence that the information accessed had been misused or leaked online.
The company also observed no signs of system compromise or data manipulation as a result of this incident and did not experience any service outages.
The company said those affected would receive individual notifications.
“We are working diligently to assess the extent of the damage and determine the cause and will take the necessary measures to strengthen security.” Nikkei explained.
This is the third cybersecurity incident that Nikkei recently announced. Earlier this month, the company disclosed a breach that occurred in late July when hackers compromised an employee’s Google Workspace account and accessed personal information about employees and business partners.
In September, Nikkei announced that threat actors had hijacked and used another employee’s Microsoft 365 account Send spear phishing emails to the company’s employees.
BleepingComputer has contacted Nikkei for further information on the latest breach and we will update this post once we receive a response.
