For: anyone registered with services of Nikkei Inc. or Nikkei National Geographic, and anyone who manages cloud environments used for development. This article is based on the official notices from Nikkei Inc., the Japanese newspaper publisher, and its group company Nikkei National Geographic, and does not cover attack techniques.
Developing: this article will be updated as the organisation publishes more
As of October 24, 2026Not yet known
- Which services' users are affected
- Counts per data item (address, phone, birth date) and number of people
- How the credentials were stolen
- How the access was detected
- How and when affected people will be contacted
- Results of the review of the scope
The company says it is reviewing the scope of the intrusion and the personal data that leaked, and is working to understand the damage and identify the cause. No timing for an update is given.
As of October 24, the company's notices list had no follow-up on this case; on October 23 it announced a change to its inquiry form (a precautionary step).
What Nikkei service users should do today
Do not open links in emails claiming to be Nikkei or a group company
About 120,000 records include an email address, and some also include name, postal address, phone number or date of birth. In general, leaked contact details attract fake messages that use the company's name and the recipient's real name. The notice does not warn about fake messages; this is a precaution.
Even if the subject says something like "Our apologies", "Compensation" or "Please verify your account" (this site's examples), do not log in through the link. Open official sites from a bookmark or your own search. How to spot fakes is covered in What is phishing.
If you get an individual notice, compare it with the notice page
The company says it will notify individually those whose personal data is confirmed to have leaked. It does not say how or when.
If you receive one, compare what it says with Nikkei's notice page, opened yourself. If it asks you to enter personal details or a card number through a link, stop and check via the inquiry form.
Do not give personal details to callers
Some of the leaked records include phone numbers. If a caller claiming to be Nikkei or a group company asks you to confirm your address or date of birth, or asks for a card number or password, do not answer; hang up.
If you call back, use a number you have checked on the official site, not one the caller gave you.
If unsure, ask through the inquiry form
The company directs questions about this case to an inquiry form; open it from the notice page. On October 23 the company said it had temporarily changed the form as a precaution after a serious vulnerability was found in the PHP programming language.
Nikkei National Geographic also says that inquiries about this case should go to Nikkei Inc.
What happened (from Nikkei's notice)
Nikkei Inc. published "不正アクセスによる個人情報漏洩について" (On the leak of personal information through unauthorized access) on October 16, 2026. Everything below is based on the notices from Nikkei and Nikkei National Geographic.
October 7, 2026, early hours to morning
According to the company, a cloud service used for system development was accessed with stolen credentials, and personal data stored in the cloud leaked.October 11
The company reported the incident to the Personal Information Protection Commission.October 16
The notice was published. As of that day, about 1.83 million records had leaked, and no secondary harm or system abnormality had been confirmed.October 17
Nikkei National Geographic said information on users of its services might be included.October 22
Nikkei National Geographic said information on some users of its services was included. Most was identifiers only, but some included at least one of name, email address, postal address, phone number or date of birth.October 23
Nikkei announced a temporary change to its inquiry form (a precaution following a PHP vulnerability).
The notice does not say when or how the company noticed the access.
- Organisation
- Nikkei Inc.
- What was accessed
- A cloud service the company uses for system development (not named)
- Leaked data
- About 1.83 million records as of October 16. About 150,000 contained at least one of name, email address, postal address, phone number or date of birth (about 120,000 of them with an email address). About 1.68 million were identifiers only, which cannot identify a person on their own
- Not included
- Credit card information
- Cause
- Credentials for accessing the cloud service were stolen by some means. How they were stolen has not been disclosed
- Response
- Disabled the credentials used in the access. Reviewing the scope and the leaked personal data
- Report
- Personal Information Protection Commission (October 11)
- Secondary harm
- No misuse or other secondary harm, and no system outage or data tampering, confirmed as of October 16
- Contacting people
- Those whose data is confirmed to have leaked will be notified individually (method and timing not stated)
- Group company
- Information on some users of Nikkei National Geographic services was included (that company, October 22)
Personal data leaked: about 1.83 million records (as of Oct 16)
Stored in a cloud service used for system development
About 150,000
At least one of name, email, postal address, phone, birth date; about 120,000 include an email address
About 1.68 million
Identifiers only, not identifying on their own
↓ Reader action mainly concerns the 150,000
Check emails and calls using the company's name on the official site
Credit card information not included (company)
What is known and what is not
This is the state as of October 24, 2026. When a follow-up is published, the status column will be updated.
| Item | What the notice says | Status |
|---|---|---|
| When the access happened | Early hours to morning of October 7 | Confirmed (company) |
| Number of records leaked | About 1.83 million as of October 16 | Leak confirmed (company) |
| Name, email, postal address, phone, birth date | About 150,000 contain at least one; about 120,000 of those include an email address. No per-item counts | Leak confirmed (company) |
| Identifier-only records | About 1.68 million; cannot identify a person on their own | Leak confirmed (company) |
| Credit card information | Not included | Not included (company) |
| Passwords | Not listed among the leaked items | Not mentioned |
| Which services | Not stated. Some Nikkei National Geographic users were included | Not mentioned / Confirmed (Nikkei National Geographic) |
| How many people | Given as records, not people | Not mentioned |
| Cause | Cloud service credentials stolen by some means; method not stated | Disclosed (company); details under investigation |
| Scope of the intrusion | Under review | Under investigation |
| Secondary harm, system abnormality | None confirmed as of October 16 | Not confirmed (company) |
| Report to the regulator | October 11 | Confirmed (company) |
| Contacting affected people | Individual notice to those confirmed | Planned (company) |
Reading note: 1.83 million is not a number of people
The roughly 1.83 million is a count of records, not of people. About 1.68 million of them are identifiers only, which cannot identify a person on their own. About 150,000 include names, email addresses or similar details.
What the leaked items can be used for
The following describes what can happen in general, not what has happened in this case. The company says no secondary harm had been confirmed as of October 16.
Items the notice says leaked
- At least one of name, email address, postal address, phone number, date of birth (about 150,000)
- Identifiers that cannot identify a person on their own (about 1.68 million)
Not included, or not mentioned
- Credit card information (not included)
- Passwords (not listed among the leaked items)
With a name and an email address, a fake email can address you by your real name. A correct name makes a message look genuine, but it is not proof. Where a postal address or phone number is included, letters or phone calls can be faked too.
Separately, on October 4 the company disclosed that a third party appeared to have logged in to an employee's account for cloud business software used for work, and that about 9,000 emails leading to a malicious site were sent to colleagues, news sources and others. At the time it warned that emails impersonating people at the company or group companies might increase. The notice does not link that case to this one, but treat links carefully even in emails that appear to come from a real Nikkei address.
Other October 2026 cases centred on email addresses are the Capcom CAPCOM ID breach and the Lawson ID breach. The cause and scope differ from case to case, so this one will not necessarily follow the same course.
For people who manage cloud environments used for development
The notice does not say whether the environment accessed was used for production or testing, why personal data was there, what kind of credential was used, or whether multi-factor authentication was in place. What follows are general checks that do not assume any of these.
The cause the company disclosed is that credentials for a cloud service used for development were stolen. How they were stolen has not been disclosed, so this section cannot say how to prevent it. It is not an assessment of the company's response.
Check whether real personal data sits in development environments
According to the notice, the service accessed was a cloud service used for system development, and personal data stored there leaked.
Take stock of customer data in your own development environments, and where real data is not needed, replace it with synthetic data or data with names and contact details removed.
Shorten the lifetime and narrow the reach of cloud credentials
According to the company, stolen credentials were used for the access. The notice does not say what kind.
As general checks, start with three things: switch to short-lived credentials with an expiry, disable credentials that are not in use, and limit what each credential can read to the data it needs. The problem of leaked credentials staying valid is covered in the study of credentials published on GitHub that still worked, and where to keep them in .env and API key basics.
Keep identifiers and contact details in separate places
The company says about 1.68 million of the roughly 1.83 million records were identifiers only, which cannot identify a person on their own.
In general, keeping data used for analysis or development to identifiers only, stored apart from names and contact details, reduces the impact on users if one side leaks. The trend of credentials being the way in is analysed in How 2026 breaches in Japan got in.
Sources (public record)
The facts in this article are based on the public information below. How the credentials were stolen and which services are affected have not been disclosed and are not guessed at.
- Nikkei Inc., "不正アクセスによる個人情報漏洩について" (Japanese, October 16, 2026; addendum October 23) — nikkei.co.jp
- Nikkei Inc., "情報漏洩などに関するお問い合わせフォーム変更のお知らせ" (inquiry form change, Japanese, October 23, 2026) — nikkei.co.jp
- Nikkei National Geographic Inc., notice on user information in connection with the unauthorized access to Nikkei (Japanese, October 17, 2026) — natgeo.nikkeibp.co.jp
- Nikkei National Geographic Inc., notice on the leak of users' personal information in connection with the unauthorized access to Nikkei (Japanese, October 22, 2026) — natgeo.nikkeibp.co.jp
- Nikkei Inc., "サイバー攻撃による情報漏洩、不審メールの送信について" (Japanese, October 4, 2026; a separate case) — nikkei.co.jp
- Nikkei Inc., "不正ログインによる情報漏洩について" (Japanese, October 4, 2026; a separate case) — nikkei.co.jp
- Nikkei Inc. notices list (checked October 24) — nikkei.co.jp
Update history
2026-10-24: First version, based on Nikkei's notice of October 16 (including the October 23 addendum) and its October 23 notice, and Nikkei National Geographic's notices of October 17 and 22 (all checked on October 24). This article will be updated when the affected services or details of the cause are disclosed.
Read next
- Cases from the same period: Capcom CAPCOM ID breach / Lawson ID breach
- Preparing for fake messages: What is phishing / Spam from your own email address
- Credentials as the way in: How 2026 breaches in Japan got in / Credentials published on GitHub that still worked
- Protecting accounts: Choosing a password manager / Choosing multi-factor authentication
- Other incidents of 2026: Data breaches and cyberattacks of 2026 (Japan and worldwide)