Japanese media giant Nikkei has disclosed two separate cybersecurity incidents involving employee email accounts, highlighting how cloud identities have become one of the most valuable entry points into modern organizations.
The incidents affected accounts hosted on Microsoft 365 and Google Workspace, giving attackers access to employee mailboxes and potentially exposing information contained in emails and cloud services. Nikkei says investigations have not found evidence that its core publishing systems or customer databases were compromised.
The breaches nevertheless demonstrate a security problem increasingly common across large organizations: attackers do not always need to penetrate corporate infrastructure when stealing a trusted employee identity can provide direct access to valuable data.
Two Separate Cloud Account Compromises
The first incident involved a Microsoft 365 account belonging to an employee of Nikkei China (Hong Kong). The company discovered the unauthorized access in July after suspicious activity was detected and immediately disabled the affected account.
Nikkei’s investigation found that the attacker had accessed the employee’s email account and potentially viewed messages containing personal information.
A separate incident affected a Google Workspace account used by another employee. Nikkei detected suspicious access in September and again disabled the account while investigating the compromise.
The company has not publicly connected the two incidents or attributed them to a particular threat actor.
Email Accounts Are Now High-Value Infrastructure
Corporate email has always been attractive to attackers, but cloud productivity platforms have significantly increased the value of a compromised account.
A Microsoft 365 or Google Workspace identity can provide more than access to email. Depending on permissions and configuration, the same credentials or session may provide access to documents, calendars, internal directories, shared drives and other connected business applications.
Email also provides attackers with valuable context.
An intruder reading an executive or employee mailbox can learn how an organization communicates, identify suppliers and customers, study ongoing projects and potentially use existing conversations to launch convincing phishing or business email compromise attacks.
That makes account takeover particularly dangerous even when attackers never deploy malware inside the victim’s network.
Identity Has Become the New Perimeter
The Nikkei incidents reflect a broader shift in enterprise security. As organizations move applications and data into cloud platforms, the traditional corporate network becomes less important as a security boundary.
Identity increasingly takes its place.
Attackers have adapted accordingly. Credential phishing, session-cookie theft, adversary-in-the-middle attacks, malicious OAuth applications and MFA fatigue can all provide access to legitimate cloud accounts without requiring exploitation of the organization’s servers.
Once authenticated, malicious activity can also be difficult to distinguish from ordinary employee behavior. A request coming from a valid Microsoft or Google account may appear legitimate unless organizations monitor location, device characteristics, session behavior and unusual access patterns.
Containing the Account Is Only the First Step
Nikkei says it disabled the affected accounts and strengthened security measures following the incidents. Determining the full impact of a cloud account compromise, however, requires more than resetting a password.
Security teams must examine authentication logs, active sessions, forwarding rules, OAuth permissions and access to connected services. Attackers may create persistence mechanisms that allow them to retain access even after credentials have been changed.
Organizations also need to understand what information the compromised account could reach and whether the attacker used that identity to contact other employees or external partners.
The incidents at Nikkei appear limited compared with ransomware attacks or major network intrusions, but that is precisely what makes them representative of modern cyber risk.
A successful breach no longer needs to begin with sophisticated malware or an unpatched server.Sometimes the entire attack surface is a legitimate cloud account — and the trust attached to it.