Nikkei Email Breach: Hijacked Microsoft 365 Account Sent About 9,000 Phishing Emails

Oreaxe may earn a commission if you buy through links on this page. How we make money.

Japanese media group Nikkei disclosed on October 4, 2026 that attackers broke into employee email accounts on Google Workspace and Microsoft 365, and used a hijacked Microsoft 365 account to send about 9,000 phishing emails to colleagues and outside contacts. In our view, the Nikkei email breach follows a pattern common in attacks on small firms: one stolen mailbox, then a wave of convincing messages sent from a real company address.

What happened

Nikkei published two notices on its corporate site on October 4, 2026. The first covers an employee’s Google Workspace account that saw unauthorized logins from late July. Google alerted the company in early August, Nikkei reset the passwords, and it puts the possible exposure at 1,646 people, covering their names and email addresses. Reader and news-source data were not involved, according to the company.

The second notice is the more instructive part of the Nikkei email breach. An outside party took over an employee’s Microsoft 365 business account, and on September 30, 2026 it was used to send roughly 9,000 impersonation emails carrying links to malicious websites. The recipients were internal staff, plus interviewees and other contacts who had dealt with several Nikkei employees. Nikkei says names, email addresses and parts of email content appear to have leaked, and that it has reported the incident to Japan’s Personal Information Protection Commission.

Nikkei has changed the passwords, contacted recipients one by one and asked them to delete the messages. BleepingComputer notes the company has not named an attacker or said whether the two intrusions are linked. The same outlet points out this is not Nikkei’s first email-driven loss: in 2019 a Nikkei America employee was tricked in a business email compromise scam that cost about $29 million.

How the attack works

Neither notice explains how the Nikkei email breach began, so we won’t guess at the entry point. What happened next is well documented, though. MITRE ATT&CK tracks it as Internal Spearphishing (T1534): once an attacker controls a legitimate account, they use its trusted status to phish colleagues inside the same organization. Sending the same lures to outside contacts from that account is a closely related abuse.

That trust is the whole trick. Many recipients had dealt with Nikkei staff before, and the message really did come from a company address. Going on the sender address alone, recipients had little reason for suspicion.

Microsoft lists the tell-tale signs of a compromised Microsoft 365 mailbox: inbox rules that forward mail to unknown addresses or shunt it into Junk Email or RSS Subscriptions, newly added external forwarding, odd items in Sent or Deleted Items, and the mailbox being blocked from sending. Treat any one of those as a reason to investigate.

Why the Nikkei email breach matters for small businesses

In our experience, many small firms run their whole operation out of Microsoft 365 or Google Workspace. One stolen mailbox gives an attacker your client list, your invoice threads and a sender address your customers trust. That is the raw material for invoice fraud. The $29 million business email compromise loss at Nikkei’s US subsidiary in 2019 shows how costly email-driven fraud can be.

There’s a second-order cost. Nikkei now has to warn people that fake emails impersonating staff at Nikkei and its group companies may increase. For a 20-person accounting firm or agency, we’d expect that kind of warning to clients to do real reputational damage, even when no money moves.

Notification duties depend on the laws that apply to your business. Nikkei reported to Japan’s regulator. In the UK, the ICO’s breach assessment guidance says you must notify it when a breach is likely to pose a risk to people. A mailbox full of client correspondence usually needs that assessment done properly, not waved away.

What to do now

1. Check sign-in logs this week. In Microsoft Entra sign-in logs or the Google Workspace admin console, look for successful logins from unfamiliar countries, IP ranges or devices since the start of summer, as far back as your log retention allows.
2. Audit forwarding and inbox rules. Microsoft’s guidance gives the PowerShell to list ForwardingSmtpAddress and hidden inbox rules per mailbox. Delete anything you can’t explain. Separately, consider blocking automatic external forwarding for the whole tenant.
3. Enforce MFA on every mailbox, including shared and service accounts. Our MFA tools guide covers options that work for small teams. Where you can, choose phishing-resistant options such as passkeys or hardware security keys, and avoid SMS codes.
4. Rehearse the response. If a mailbox is compromised, Microsoft’s order is: disable the account or reset the password, revoke sessions, remove unknown MFA methods, review consented apps and admin roles, then check forwarders. Write that down before you need it.
5. Kill password reuse. A unique, generated password per account limits how far one leaked credential travels. A team password manager such as Proton Pass (see plans) makes that practical, and its paid plans add dark web breach monitoring; our password manager comparison covers the alternatives.
6. Tell staff what to expect. If you’re ever in Nikkei’s position, warn clients quickly and give them a way to verify requests by phone.

Oreaxe’s take

The useful detail in the Nikkei email breach is the timeline. The Google Workspace intrusion started in late July and was caught only when Google flagged it in early August. In our experience, many small firms have no one reading those alerts at all. Make sure provider security notifications go to a monitored address, not to the person who set up the tenant three years ago.

In our view, the hijacked mailbox is one of the most common ways an attack on a small business begins. It needs no exploit and it abuses trust you’ve already built. The fixes are unglamorous: MFA everywhere, no automatic external forwarding, someone checking sign-in logs. We’d prioritise those over buying another email filter, because filters have a harder job when the phishing comes from a genuine mailbox on your own domain.

Sources

• Nikkei Inc., Notice of unauthorized access to Microsoft 365 account, October 4, 2026
• Nikkei Inc., Notice of unauthorized login and information leakage (Google Workspace), October 4, 2026
• BleepingComputer, Nikkei discloses breaches of employees’ Microsoft, Google email accounts, October 6, 2026
• The Cyber Express, Nikkei Cyberattack: 9,000 Spoofed Emails And A Breach, October 5, 2026
• Microsoft Learn, Responding to a compromised email account
• MITRE ATT&CK, Internal Spearphishing, T1534
• ICO, Personal data breach assessment

Every factual claim links to its source. Spotted an error? Tell us.