**Nikkei Inc.**, a prominent Japanese business news and financial information group and owner of the **Financial Times**, is grappling with a series of cybersecurity incidents. The most recent disclosure reveals a breach that exposed 1.83 million personal information records, marking the third such incident within a month. ### Details of the Latest Breach The company confirmed that unauthorized actors gained access to a development system on October 7, utilizing stolen credentials. This access subsequently exposed personal information stored in the cloud. Of the 1.83 million records, approximately 150,000 contained personally identifiable information (PII) such as full names, email addresses, physical addresses, telephone numbers, and dates of birth. Email addresses were present in 120,000 of these records. The remaining 1.68 million records reportedly contained no identifying information, and **Nikkei** has assured that no credit card data was compromised in this incident. ### Company Response and Ongoing Investigation Upon discovery, **Nikkei** promptly revoked the compromised credentials and notified the **Personal Information Protection Commission** on October 11. The company states it is actively investigating the full scope of the breach and, as of October 16, has found no evidence of the accessed information being misused or leaked online. Furthermore, there are no signs of broader system compromise or data tampering, and no service outages have been reported. Impacted individuals are expected to receive direct notifications. **Nikkei** affirmed its commitment, stating, “We are working urgently to establish the extent of the damage and determine the cause, and will implement the necessary measures to strengthen security.” ### A Pattern of Incidents This latest breach follows two other significant cybersecurity incidents disclosed by **Nikkei** earlier this month. In late July, the company experienced a breach where an employee's **Google Workspace** account was compromised. This led to unauthorized access to personal information belonging to both employees and business partners. Prior to that, in September, threat actors hijacked another employee’s **Microsoft 365** account. This compromised account was then used to dispatch spear-phishing emails to the firm’s staff, indicating a sophisticated and targeted approach by the attackers. The repeated nature of these breaches highlights the persistent challenges organizations face in securing their digital assets, particularly against credential-based attacks.