Japanese Media Firm Nikkei Suffers Cyberattack Due to Employee Error
This Isn't the First Time Nikkei Has Been Attacked
Nikkei, one of Japan’s largest and most respected media outlets, has been hit by a cyberattack—this after an employee’s computer was supposedly infected by malware, resulting in Nikkei’s Slack messaging platform being compromised and exposing the personal data of more than 17,000 employees and business partners.
However, in a statement, Nikkei maintains none of its reporting-related sources have been compromised by the attack. It also vowed to take serious and proactive action to address the incident.
“Potentially leaked information includes the names, email addresses, and chat histories for 17,368 individuals registered on Slack… No leakage of information related to sources or reporting activities has been confirmed. We take this incident seriously and will further strengthen personal information management to prevent any recurrence,” Nikkei said in a statement.
From Endpoint Compromise to Something More Sinister
The cyberattack, according to Digital Journal, is a form of ransomware, although the focus is data exfiltration. In addition, Mayank Kumar, the Founding AI Engineer of DeepTempo, described the attack as following the modern attack lifecycle, where compromising an endpoint is the prelude to a larger, more sinister attack.
“The Nikkei breach is a textbook example of the modern attack lifecycle, which pivots from a compromised endpoint directly to a high-value SaaS application,” Kumar told Digital Journal. “The initial malware infection was just a foothold. The true objective was to steal valid credentials, allowing attackers to ‘live off the land’ and blend seamlessly into normal business activities. Once inside Slack, they appeared to be legitimate employees, rendering signature-based or rule-based tools completely blind.”
Perhaps worryingly, this isn’t the first time Nikkei has been breached. Back in September 2019, the same media outlet lost an estimated USD $29 million due to a business email compromise attack, ironically due to employee errors as well. This time, scammers posed as a Nikkei executive to scam an employee into sending funds to a bank account. Then, in May 2022, a subsidiary of Nikkei in Singapore was hit by a ransomware attack that reportedly zeroed in on a server containing customer data.
A Wakeup Call for Nikkei, Other Busineses
For Kumar, this latest incident is a wake-up call not only for Nikkei but for other organisations as well to rethink their approach to cybersecurity and fortify it accordingly.
“This is precisely why detection must evolve from looking for known ‘bads’ to recognising malicious intent as it emerges. The critical challenge is no longer just stopping malware; it is about detecting an authenticated user whose intent—that is, scraping 17,000 records—is fundamentally different from how the system routinely operates… This requires a new approach that can identify subtle attacker progression patterns, even within encrypted traffic, and adapt automatically as attackers change their methods. A stolen password should be a minor alert, not a catastrophic breach.”
As of press time, it is still unclear if Nikkei’s latest incident is of the catastrophic kind. But it does highlight once more the need for better cybersecurity in this digital age full of cyber adversaries.
