Japanese media group Nikkei has disclosed a third security incident in about a month. In a notice dated October 16, the company said a cloud service it uses for system development was accessed without authorisation in the early morning of October 7, after the credentials for that service were stolen “by some means.” About 1.83 million records of personal information leaked as of October 16.
Nikkei says roughly 150,000 of those records contain at least one of a full name, email address, physical address, phone number or date of birth, and about 120,000 of them include an email address. The other roughly 1.68 million records hold only identifiers that cannot identify a person on their own. No credit card information was involved. Nikkei revoked the abused credentials, reported the incident to Japan’s Personal Information Protection Commission on October 11, and says it had found no sign of misuse of the data, system compromise, data tampering or service outage as of October 16. It is still working out the scope and cause, and will notify people whose data was exposed individually. The notices do not say whose records were stored in the cloud service, and BleepingComputer has asked Nikkei for more detail.
According to BleepingComputer, the earlier incidents were a hijacked Microsoft 365 account used for spear-phishing in September and a compromised Google Workspace account disclosed earlier this month; both are covered in our 10-05 post.