About 9,000 phishing emails left a real Nikkei Microsoft 365 mailbox on September 30, 2026, aimed at internal staff and the journalistic sources those employees had been interviewing. Months earlier, unauthorized access had already begun on an employee Google Workspace account. According to BleepingComputer, Nikkei disclosed on October 4, 2026 that phishing had stolen employee cloud email passwords, allowing attackers to sign in, reach contact data, and later send mass malicious-link mail from a trusted corporate address. Public reporting does not establish whether multifactor authentication was absent, unenforced, or defeated on those accounts.
How an employee Google Workspace login opened first
Unauthorized access to an employee Google Workspace account began in late July 2026. Nikkei learned of it in early August after a notification from Google, then changed the password. According to the company's disclosure as reported by BleepingComputer, names and email addresses of 1,646 individuals were potentially affected. Nikkei stated that no reader data or interviewee and source data was confirmed exposed in that Google incident. The company reported the matter to Japan's Personal Information Protection Commission.
The mechanism public reporting does name is straightforward credential theft. Attackers obtained employee account passwords through phishing, then authenticated successfully to the cloud mailbox stack. Session use followed that login. Public reporting does not establish adversary-in-the-middle proxy kits, helpdesk recovery abuse, device-code phishing, or post-authentication token theft from endpoint malware as the initial path. Public reporting also does not name a threat actor or group.
Once the password worked, the attackers held a normal authenticated session on workforce Google Workspace. That is enough for mailbox and directory-adjacent visibility of the kind Nikkei described: names and email addresses tied to employees and business partners. No exotic privilege escalation story is required when the front door accepts a phished password and treats the login as legitimate.
Nikkei changed the compromised password after discovery. The company said no further unauthorized logins were confirmed after the resets on the disclosed accounts. That containment step stops new password reuse on those credentials. It does not rewrite the window from late July until the early August discovery, when the account was already usable.
What the Microsoft 365 mailbox did on September 30
Separately, an employee Microsoft 365 account was compromised in September 2026. On September 30, that account sent about 9,000 emails containing links to malicious websites. According to Nikkei's statement via BleepingComputer: "On September 30th, emails containing links to malicious websites were sent to internal staff and to interviewees with whom several employees had been in contact." Recipient names and email addresses, and some message content, may have been exposed through that activity.
The operational damage is larger than a quiet inbox scrape. A real Nikkei Microsoft 365 identity became the delivery channel. Internal staff and external journalistic contacts received mail that looked like it came from a colleague or a known corporate address. That is classic trusted-mailbox abuse after account takeover: the filter and the human both start from a higher trust baseline than they would for a random external sender.
Nikkei again changed passwords and contacted recipients. The company stated: "Our company has changed its passwords, and no unauthorized logins have been confirmed since then. We have contacted the recipients individually and requested that they delete the emails." Public reporting does not establish a confirmed link between the Google Workspace incident and the Microsoft 365 incident. They remain two workforce cloud-mail takeovers disclosed together unless Nikkei or investigators later prove a single chain.
| Control surface | What reporting shows | What failed in practice |
|---|---|---|
| Employee password | Stolen via phishing | Password alone completed cloud login |
| Google Workspace account | Access from late July 2026 | 1,646 names/emails potentially affected |
| Microsoft 365 account | Used 30 Sep 2026 | ~9,000 malicious-link emails sent |
| MFA on those accounts | Not described | Public reporting does not establish status |
| After reset | No further unauthorized logins confirmed | Earlier access window already used |
The same corporate family has other recent and historical hits that sit beside this disclosure without proving a shared 2026 operator. BleepingComputer notes a prior-year Nikkei Slack breach affecting more than 17,000 employees and business partners, a 2022 ransomware incident at a Singapore subsidiary, and a 2019 Nikkei America business email compromise that cost roughly $29 million. Those are adjacent context for a media group that keeps landing in email and collaboration incident roundups. They are not evidence that the 2026 Google and Microsoft account takeovers share one actor or one kit.
Why stolen passwords still finish workforce cloud login
Both disclosed paths are credential-phase failures at employee IdP and mailbox login. The attacker needed a password that the identity provider would accept. Public reporting frames the vector as phishing credential theft, not as malware lifting cookies from an already-good session on a locked-down PC. Closing a phishable employee login stops this path. Malware after a legitimate login is a harder, separate problem.
Public reporting does not establish which second factor, if any, sat in front of those Google Workspace and Microsoft 365 accounts. That gap matters for blame theater and almost nothing for architecture. If MFA was missing, a password was enough. If SMS, email codes, OTP, or push were present, those factors are still transferable under live phishing coaching. If only the password was stolen and no second factor was enforced, the story is even thinner. None of those variants is spelled out in Nikkei's public account. What it does document is that passwords were stolen, authentication succeeded, and mail and contact exposure followed.
Outbound mail from the Microsoft 365 account shows why mailbox takeover is not a "data at rest only" problem for a newsroom. Staff and sources are trained to open mail from known reporters and desks. Roughly 9,000 malicious-link messages from a real employee identity turn that trust into scale. Password reset and recipient notification are necessary hygiene after the fact. They do not prevent the next employee password from completing the same login ceremony.
Device-bound, phishing-proof workforce authentication removes the password-and-OTP surface so a phished secret alone cannot finish employee cloud mailbox login. That is the prevention claim for this class of breach. Revoke and password change remain hygiene after a successful login has already happened.
If you want to skip the attack details and go straight to what can stop this, read the related article on mfa2point0.com: how phishing-proof MFA blocks Nikkei-style employee mailbox takeover.
FAQ
How did attackers get into Nikkei employee cloud mail?
Attackers got into Nikkei employee cloud mail by stealing employee account passwords through phishing, then signing in successfully to Google Workspace and Microsoft 365. According to BleepingComputer's coverage of Nikkei's October 4, 2026 disclosure, that credential theft enabled unauthorized Google Workspace access from late July 2026 and a Microsoft 365 compromise used on September 30 to send mass phishing. Public reporting does not establish the exact phishing lure design or whether MFA was present on those accounts.
What data was at risk in the Nikkei Google Workspace incident?
In the Nikkei Google Workspace incident, names and email addresses of 1,646 individuals were potentially affected. Nikkei reported that no reader data and no interviewee or journalistic source data was confirmed exposed in that Google account compromise. Discovery followed a Google notification in early August 2026, after unauthorized access had begun in late July.
What happened with the compromised Nikkei Microsoft 365 account?
The compromised Nikkei Microsoft 365 account sent about 9,000 emails with links to malicious websites on September 30, 2026. Recipients included internal staff and external contacts such as interviewees and sources several employees had been in contact with. Recipient contact details and some message content may have been exposed. Nikkei changed passwords, said no further unauthorized logins were confirmed afterward, and asked recipients to delete the messages.
Were the Google Workspace and Microsoft 365 breaches the same attack?
Public reporting does not establish that the Nikkei Google Workspace and Microsoft 365 incidents were the same attack or shared one operator. Nikkei disclosed both workforce cloud-mail takeovers together after phishing stole employee passwords, but the timelines differ (Google access from late July, Microsoft 365 mass mail on September 30) and no joint technical link is documented in the public account.
Did multifactor authentication fail at Nikkei?
Public reporting does not establish whether multifactor authentication was absent, bypassed, or not enforced on the breached Nikkei Google Workspace and Microsoft 365 accounts. What is documented is password theft via phishing and successful authentication afterward. That is enough for account takeover and outbound mail abuse regardless of which transferable second factor, if any, was supposed to sit behind the password.
