[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUpGp3I5t-4k58lqU_OfOxSuPCHU2kOaUXDWxLFadeQg":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"11752775-15d0-40ba-b4e7-38775ee3b527","nikkei-employee-email-accounts-hijacked-used-to-launch-internal-phishing-campaign","ac5d499c-049e-4328-bce4-1a1628c9d1fa","Nikkei Employee Email Accounts Hijacked, Used to Launch Internal Phishing Campaign","Two Nikkei employee accounts — one Google Workspace and one Microsoft 365 — were compromised by unknown attackers, exposing partner data and enabling a large-scale internal phishing campaign that reached 9,000 recipients. The core failure lies in insufficient access controls, most likely the absence of multi-factor authentication (MFA) on corporate email accounts. Once inside, attackers leveraged the trusted identity of the compromised accounts to pivot and target more victims, a classic credential abuse pattern. This incident highlights how a single weak account can become a launchpad for broader organizational harm, and why reactive measures like password resets alone are insufficient without systemic hardening.","**Immediate actions:**\n- Enforce multi-factor authentication (MFA) on all corporate email accounts across Google Workspace and Microsoft 365 immediately.\n- Audit all active email accounts for suspicious login locations, forwarding rules, or delegated access and revoke unauthorized configurations.\n- Notify all 9,000 phishing email recipients with clear guidance on how to identify and report follow-up social engineering attempts.\n\n**Long-term improvements:**\n- Implement a Zero Trust access model requiring continuous verification for all SaaS applications, not just at login.\n- Establish a formal Identity and Access Management (IAM) policy with regular access reviews to detect dormant or over-privileged accounts.\n- Deploy email authentication protocols (DMARC, DKIM, SPF) to reduce the ability of compromised internal accounts to send spoofed or malicious mail at scale.\n\n**Detection measures:**\n- Enable SIEM or CASB integration with Google Workspace and Microsoft 365 to alert on anomalous login behavior such as impossible travel or off-hours access.\n- Set up automated alerts for bulk outbound email activity from individual accounts to catch phishing campaigns before they fully propagate.\n- Conduct regular threat-hunting exercises focused on credential compromise indicators across cloud productivity platforms.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 5 – Account Management","CIS Control 6 – Access Control Management","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-5 (Authenticator Management \u002F MFA)","NIST SP 800-53 SI-8 (Spam Protection)","NIST Cybersecurity Framework PR.AC-1, DE.CM-1","GDPR Article 32 – Security of Processing","GDPR Article 33 – Notification of Personal Data Breach","ITIL – Information Security Management (Service Management Practice)","ISO\u002FIEC 27001 – A.9 Access Control, A.16 Incident Management",{},"published","2026-10-06T10:20:51.708359+00:00","2026-10-06T10:20:51.402+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnikkei-discloses-breaches-of-employees-microsoft-google-email-accounts\u002F","nikkei-discloses-breaches-of-employees-microsoft-google-email-accounts-8a0721","Nikkei discloses breaches of employees’ Microsoft, Google email accounts",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"182e11d5-57c4-444e-8ec8-4682ad60261b","Incident Response","incident-response","Slow detection, poor containment, missing playbooks","#14b8a6",{"id":40,"name":41,"slug":42,"description":43,"color":44},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":46,"name":47,"slug":48,"description":49,"color":50},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",[],[53,57,61],{"slug":54,"name":55,"problem":56},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":58,"name":59,"problem":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":62,"name":63,"problem":64},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes."]