Nikkei says a stolen cloud login leaked 1.83 million records

Nikkei Inc. says a cloud service it used for system development was accessed without authorization on the morning of October 7, 2026, and that about 1.83 million items of personal information were leaked. The company posted the notice on October 16. It still does not know how the login was stolen.

If you have no Nikkei account, subscription, or other relationship with the company, this is not your record. The notice is short, and a few of its numbers are easy to misread.

What the notice actually counts

Nikkei’s English announcement splits the 1.83 million items:

• About 150,000 items contained at least one of: name, email address, postal address, phone number, or date of birth. About 120,000 of those included an email address.
• About 1.68 million items contained only information Nikkei says cannot identify a person.
• No item included credit card information.

“Items” is the word Nikkei uses. It does not say these are 1.83 million people, and it does not say the 150,000 identifiable items are 150,000 separate readers. It says it is still reviewing the scope and the personal information that leaked.

The access ran from the early hours to the morning of October 7. Nikkei says the credentials had been stolen by unknown means, and that it has since disabled them. It reported the incident to Japan’s Personal Information Protection Commission on October 11.

As of October 16, Nikkei said it had found no misuse of the leaked information, no tampering, and no outage of Nikkei’s own systems. It said it will contact each person whose personal information it confirms was leaked.

The October 23 note on the contact form

The same page carries an update dated October 23: Nikkei changed its inquiry form because of a vulnerability identified in the PHP programming language. The notice does not say that vulnerability is how the cloud login was stolen, and it does not name a PHP version or a bug number. Those are separate sentences. Treating the form bug as the cause of the leak would be adding a link Nikkei did not make.

If Nikkei has told you to use the form, use the one on Nikkei’s own site, not a look-alike sent by email. The address in the notice is the inquiry form at esf.nikkei.co.jp. Media inquiries go to the corporate communications office, not to readers.

What to do if you have a Nikkei account

1. Wait for Nikkei to contact you, and check that the message is actually theirs. The company said it will write to each person it confirms was in the identifiable set. A message that asks you to “confirm” a card number is not this notice. Nikkei says card data was not in the leak.
2. If your email address was in the 120,000, expect more targeted mail. A name plus an email address is enough for a convincing fake. The company said that as of October 16 it had not found misuse. That date is already a week old. It is not a finding that misuse cannot start later.
3. Change the password on the Nikkei account if you reused it anywhere else. Nikkei has not said account passwords were in the copied items. It said the stolen credential was the one used to reach the development cloud. Reuse is the reason to change a password you also used on an unrelated site. A password that existed only inside a Nikkei account, and was not described as leaked, is a lower priority than the email address itself.

There is no Canadian regulator step attached to this notice. Nikkei reported it to Japan’s commission. A reader in Canada who is a Nikkei subscriber follows the company’s contact, not a local breach form, unless a later notice says otherwise.

Sources

• Nikkei Inc., Personal Information Leak Due to Unauthorized Access, October 16, 2026, with an update on October 23, 2026