Per Nikkei’s notice, about 150,000 of the leaked items contain one or more of name, email address, postal address, phone number or date of birth, and about 120,000 of those include an email address. The other about 1.68 million items contain only information that can’t identify a person on its own. No credit card information is in any of it.
What it has done. Nikkei reported the incident to Japan’s Personal Information Protection Commission on Oct 11 and has disabled the credentials used in the access. It says it has found no secondary damage such as misuse of the data, and no system outages or data tampering. It’s still working out the full scope and the cause, and says it will contact each affected person. Which cloud service was involved: Undisclosed.
Why a security team should care. This wasn’t the production site. It was a cloud service used for building systems, and it was holding real personal data. That’s a pattern a lot of shops share: staging and dev tenants seeded with production records, guarded by credentials that get far less scrutiny than prod logins. It also lands in a busy week for Japanese disclosures, after Burger King Japan and Sourcenext.
What we’d check. Find every non-production cloud tenant that holds real customer data and either mask it or treat it as prod. Put dev and CI service logins behind the same MFA and conditional-access rules as production, rotate long-lived tokens, and alert on bulk reads or exports from those tenants. Nikkei only knows the credentials were stolen, not how, so check where your developers’ cloud credentials live: laptops, repos, CI variables and infostealer logs.