Nikkei employee Microsoft 365 account compromised, 9,000 phishing emails sent to sources and contacts

Nikkei disclosed that an attacker compromised one employee's Microsoft 365 account and used that legitimate identity to send roughly 9,000 phishing emails. The messages went to the employee's contacts, including journalistic sources who had reason to trust the sender, and pushed recipients toward fraudulent websites. The company says the employee changed the password immediately after discovery and that no further unauthorized logins have been detected.

The immediate operational harm looks contained, but the design of the incident is the point. A hijacked mailbox at Japan's largest business publisher turns every prior correspondent into a target, and for a news organization the recipient list itself is sensitive: sources who communicated with a reporter are exposed to follow-on phishing that could unmask them or compromise their own accounts. Nikkei has notified all recipients, told them to delete the messages without clicking, and reported the incident to Japan's Personal Information Protection Commission.

Watch whether attackers reuse the harvested contact graph against specific sources, whether Nikkei confirms any data theft beyond mailbox access, and what the protection commission's review concludes about M365 authentication controls at the company. A repeat pattern of mailbox-only intrusions with no malware makes identity and phishing-resistant MFA posture the core remediation question.