Nikkei discloses breaches of employees’ Microsoft, Google email accounts

Two Nikkei employee accounts — one Google Workspace and one Microsoft 365 — were compromised by unknown attackers, exposing partner data and enabling a large-scale internal phishing campaign that reached 9,000 recipients. The core failure lies in insufficient access controls, most likely the absence of multi-factor authentication (MFA) on corporate email accounts. Once inside, attackers leveraged the trusted identity of the compromised accounts to pivot and target more victims, a classic credential abuse pattern. This incident highlights how a single weak account can become a launchpad for broader organizational harm, and why reactive measures like password resets alone are insufficient without systemic hardening.