nikkei-m365-2026 · Disclosed 2026-10-04
Nikkei: Microsoft 365 compromise and propagation to Nikkei BP
A Microsoft 365 account sent about 9,000 spoofed messages. Nikkei BP reported credential theft through that email and possible exposure of 26 personal-data records.
Outcome: Confirmed breach
Entry path and evidence
- Reported fact
An employee Microsoft 365 account was attacked; about 9,000 spoofed messages were sent on September 30.
[s1]本文 第1–3段落 - Reported fact
Nikkei suspects exposure of recipient details and some email contents. Nikkei BP reported phishing credential theft through a Nikkei mailbox and possible exposure of 26 records.
Timeline
Reported response
- Reported fact
Nikkei changed passwords; Nikkei BP blocked account access. Both reported notifying the privacy regulator.
Cause and mitigation hypotheses
Not assessed. Editorial hypotheses have not been added for this incident; this does not establish safety or a confirmed cause.
Evidence relevant to prevention
Operational controls to inspect
The entry mechanism is undisclosed; avoidability cannot be assessed. Inspect exposure, privileges, logs and retained data using the linked rules.
Editorial assessment; not a determination of liability. [s1]
Unknowns and AI involvement
The reviewed disclosures do not establish attacker use of AI.
Nikkei’s original entry mechanism and total leakage count are undisclosed. This is separate from the existing 1,646-person Google Workspace case; 9,000 counts messages.
Sources
[s1] 日本経済新聞社 · Primary source
サイバー攻撃による情報漏洩、不審メールの送信について ↗Published 2026-10-04 · Reviewed 2026-10-19
[s2] 日経BP · Primary source
メール不正アクセスによる個人情報の漏えいについて ↗Published 2026-10-04 · Reviewed 2026-10-19