Nikkei

Attackers compromised employee email accounts at Nikkei, the Japanese publisher, and used that access to distribute phishing emails. Reporting on 6 October established the compromise and the phishing distribution.

Later reporting put the number of affected individuals at 1,646, with names and email addresses exposed. The number of compromised accounts and the entry method remain unestablished in public reporting.

Names and email addresses for 1,646 individuals, taken from compromised employee mailboxes.

For most organisations a mailbox breach means contracts, invoices and internal discussion. For a news organisation it means something else: unpublished reporting, correspondence with confidential sources, document handoffs and the identities of people who spoke on condition that their identity would never be known.

Staff, and more seriously, their sources. A source who contacted a journalist by email did so under a promise of confidentiality that the journalist can no longer guarantee was kept.

That harm has no notification path. The affected party is not a customer in a database, they are a person who sent a message years ago and whose exposure depends entirely on whether that thread was still in the mailbox. This is the same structural problem as the Navigate360 entry earlier in this series: a promise of anonymity that the underlying system was never designed to keep.

The phishing distribution adds a second class of victim, since messages arriving from a genuine Nikkei address carry the publisher's credibility to everyone who receives them.

Business email is correctly treated as a security priority, and email compromise is among the most defended-against attacks in any large organisation.

What newsroom email does not usually get is a retention policy that reflects what it holds. Mailboxes grow indefinitely because deleting correspondence feels like destroying records, and the longer a journalist works, the more complete the archive of their sourcing becomes.

What was in the mailboxes. That is the hardest content question in this series, because mailbox contents are unstructured, decades deep, and nobody has read them.

An organisation can state how many accounts were compromised within hours. Stating which confidential sources, unpublished stories and shared documents sat inside those accounts requires having examined them beforehand, which practically nobody does and which a newsroom has particular reasons to resist.

The uncomfortable implication is that the only honest scope statement available to a publisher in this position is that it does not know, and cannot know quickly.

No group has been named and no attribution appears in public reporting. Media organisations are targeted by both criminal actors seeking resale and state actors seeking source identification, and the two produce very different consequences.

Using the compromised accounts to send phishing rather than to exfiltrate quietly suggests the former, although a noisy secondary use does not rule out a quiet primary one.

Mailbox retention limits, which is an unpopular answer in newsrooms and the correct one. Correspondence that no longer serves a live story is a liability held on behalf of the person who sent it.

Second, moving source material out of email entirely. Dedicated secure drop systems exist precisely because email was never built to protect the identity of the person on the other end, and the mailbox keeps everything by default.