Loading story…
Nikkei, a major Japanese media conglomerate and owner of the Financial Times, confirmed that its internal network was breached after attackers compromised an employee's Slack account. The breach, discovered in September, resulted from malware infecting an employee's computer, which allowed hackers to steal authentication credentials and gain unauthorized access to the company's Slack messaging platform. As a result, sensitive data belonging to business partners and chat histories of 17,368 Slack users—including employees and partners—were exposed. Nikkei responded by implementing multiple countermeasures, such as mandatory password resets, and reported the incident to Japan’s data protection authorities, despite the leaked data not falling under the country’s personal information protection laws.
The company stated that there is no evidence suggesting any compromise of journalistic sources or reporting-related information. Nikkei emphasized its commitment to transparency and pledged to strengthen personal information management to prevent future incidents. The breach highlights the growing risk of collaboration tools like Slack being targeted for credential theft and lateral movement within corporate networks. This incident follows a previous ransomware attack on Nikkei’s Singapore headquarters in 2022 and comes amid a broader trend of cyberattacks targeting media organizations worldwide.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Although Nikkei assessed the incident did not trigger mandatory reporting under Japan's Personal Information Protection Law, it said it voluntarily notified Japan's Personal Information Protection Commission. This notification was disclosed as part of the company's public response to the incident.
In early November 2025, Nikkei publicly reported that personal information for 17,368 Slack-registered employees and business partners may have been exposed in the breach. The company said confidential source information and journalistic-purpose personal data were not affected.
Nikkei discovered in September 2025 that its Slack environment had been compromised and required password changes for affected accounts. The intrusion potentially exposed names, email addresses, and Slack chat histories.
Nikkei said attackers obtained authentication credentials after malware infected an employee's computer, enabling unauthorized access to the company's Slack environment. The exact date of the initial compromise was not disclosed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
8 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcecsoonline.com
Open sourcecsoonline.com
Open sourcedarkreading.com
Open sourcehackread.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Aflac Life Insurance Japan disclosed that an unauthorized third party accessed its systems between June 15 and June 25, exposing data tied to about **4.38 million customers**. The company said the compromised information included names, dates of birth, addresses, phone numbers, policy coverage details, and data related to insurance representatives and commercial agencies; roughly **230,000 records** also contained bank account information. Aflac said the incident was limited to its Japan operations, that U.S. business systems were not accessed, and that affected systems were suspended after the intrusion was discovered on June 25. The breach adds to a broader pattern of cyber incidents affecting Japanese organizations, where public reporting has shown hundreds of ransomware and extortion-related cases and frequent abuse of internet-facing systems such as VPN appliances and RDP. Research on disclosed incidents involving Japanese firms found that attackers often move quickly to leak or weaponize stolen data and increasingly time disruptive actions for nights or weekends, underscoring the operational pressure facing defenders. Aflac said it has brought in third-party cybersecurity experts and notified Japan’s Financial Services Agency and police, while stating that no confirmed misuse of the stolen data had been identified at the time of disclosure.
Jul 7, 2026
Dentsu, a leading Japanese advertising and public relations firm, confirmed that its U.S.-based subsidiary Merkle experienced a cybersecurity incident resulting in the exposure of sensitive staff and client data. The breach prompted the company to take certain systems offline as a precaution and initiate incident response protocols, including engaging third-party cyber experts and notifying law enforcement. Dentsu stated that the incident did not impact its network systems in Japan and that the financial impact remains undetermined at this time. The investigation revealed that files containing information related to clients, suppliers, and both current and former employees were accessed and stolen. Exposed data reportedly includes bank and payroll details, salary information, National Insurance numbers, and personal contact details. Impacted individuals are being notified, and Dentsu has reported the incident to relevant authorities in affected countries as required by law. Merkle, which operates globally and serves high-profile clients, is working to restore normal operations and assess the full scope of the breach.
Jul 12, 2026
Several significant data leaks and ransomware incidents have surfaced, affecting a range of organizations including Banco Vimenca, WIRED subscribers, Mexico’s Tax Administration Service (SAT), and New Zealand’s Neighbourly platform. Threat actors have claimed responsibility for exposing sensitive data such as government financial records, large-scale subscriber information, and user communications, with some incidents linked to ransomware groups. While the authenticity of these dark web postings remains unverified, the breadth of affected entities highlights ongoing risks to both financial institutions and government agencies from cybercriminal activity. In the United States, two banks—Artisans' Bank and VeraBank—have notified thousands of customers that their personal information was compromised in a ransomware attack on Marquis Software, a vendor providing data analytics and communication services to financial institutions. The attack, traced to a vulnerability in a SonicWall firewall, resulted in the exposure of names and Social Security numbers, though the banks’ own systems were not directly breached. These incidents underscore the persistent threat posed by supply chain vulnerabilities and the importance of robust third-party risk management for organizations handling sensitive data.
Jun 29, 2026