Nikkei Inc. disclosed that attackers who broke into an employee Microsoft 365 account in September used it to send roughly 9,000 messages carrying malicious links to newsroom staff and external interview subjects, the latest security lapse at Japan’s largest business publisher.
Timeline of the two incidents
In a statement over the weekend, the company said a Google Workspace account was accessed in late July, exposing contact details of employees and partners. Nikkei reset that password in early August after Google flagged suspicious activity.
Weeks later, a separate Microsoft 365 mailbox was compromised. On September 30 the account blasted phishing emails that impersonated legitimate correspondence, targeting reporters and people who had recently spoken with the paper. Nikkei changed passwords again and said it saw no further unauthorized logins.
Why media companies are targets
Publishers sit on source lists, embargoed earnings files, and government backgrounders—data useful for market manipulation or espionage. Nikkei’s brand also lends credibility to phishing lures; recipients are likelier to click links that appear to come from a trusted byline.
The company has reported other breaches in recent years, including a Slack intrusion affecting more than 17,000 people and a ransomware hit at its Singapore unit. Security teams now face pressure to segment newsroom tools from corporate finance systems.
Reader and source hygiene
Nikkei said it contacted recipients individually and asked them to delete the fraudulent messages. Interviewees who trade on sensitive information were urged to watch for follow-on scams referencing the newsroom.
For technology desks covering Japan, the episode underscores a broader pattern: even sophisticated organizations struggle with credential stuffing and session hijacks on cloud mail. Digital Agency officials separately warned citizens to verify senders after national surveys showed phishing as the most common cyber incident reported by schools and hospitals.
Corporate response
Nikkei has not attributed the attacks or said whether the July and September cases are linked. It promised additional monitoring on privileged accounts and tighter multi-factor requirements for cloud consoles.
Until those controls prove durable, sources dealing with major Japanese media should treat unexpected attachments as hostile, regardless of how familiar the display name looks.