Nikkei Confirms Email Account Breach, Thousands of Phishing Messages Sent

Japanese media conglomerate Nikkei announced over the weekend that two of its employees' Microsoft and Google email accounts were compromised by an unidentified threat actor, and that one of the hijacked accounts was used to distribute a large volume of phishing emails.

The company said the intrusion was detected after unusual outbound traffic was flagged by its security monitoring tools. Investigators determined that the attackers gained access to the accounts through credential theft, although the exact method—whether phishing, credential stuffing or another technique—has not been disclosed.

Once inside, the perpetrators leveraged one of the compromised accounts to send thousands of fraudulent messages to external contacts. The phishing emails reportedly mimicked legitimate business correspondence, aiming to lure recipients into clicking malicious links or providing further credentials. Nikkei did not provide a tally of how many recipients were targeted, but emphasized that the campaign was halted quickly after detection.

Cybersecurity experts note that corporate email accounts remain a prime vector for large‑scale phishing operations because they carry inherent trust. When a legitimate address is used, recipients are more likely to engage with the content, increasing the success rate of credential harvesting or malware delivery. The incident underscores ongoing challenges for organizations in protecting cloud‑based email services, even when multifactor authentication is in place.

Nikkei’s statement confirmed that no confidential editorial material or subscriber data appears to have been accessed or exfiltrated. The firm is cooperating with law enforcement and third‑party security firms to trace the source of the breach and to reinforce its defenses. It also warned customers and partners to remain vigilant for suspicious emails that may have originated from the compromised accounts.

The breach adds to a broader pattern of attacks on Japanese firms in recent months, as threat actors increasingly target high‑profile companies to amplify the impact of their phishing campaigns. Industry observers expect that Nikkei, along with other organizations, will review and possibly tighten access controls, expand employee security training, and deploy more advanced email authentication frameworks such as DMARC, DKIM and SPF to mitigate similar threats in the future.