One Hijacked Microsoft 365 Mailbox, 9,000 Phishing Emails: Lessons From Nikkei’s Breaches
Nikkei says attackers broke into an employee’s Microsoft 365 account and sent 9,000 phishing emails, months after a separate Google Workspace breach. Here is how layered defenses limit the damage.
Here Is How Layered Defenses Help
A single compromised mailbox is rarely the end of an attack. Usually it’s the start. Japanese media group Nikkei, owner of the Financial Times, disclosed over the weekend that attackers had broken into two employee email accounts on two different platforms. One of them was then used to send thousands of phishing messages to people who had every reason to trust it.
The briefing
- Incident one, Google Workspace: An employee’s account was accessed in late July. Nikkei found out in early August after a notification from Google and changed the password. Names and email addresses of up to 1,646 employees and business partners may have been exposed. Nikkei says readers and interviewees were not included.
- Incident two, Microsoft 365: In September another employee’s account was taken over and used to send about 9,000 phishing emails. On September 30, messages with links to malicious websites went to internal staff and to interviewees several employees had been in contact with.
- Response: Nikkei changed passwords, says it has seen no unauthorized logins since, contacted recipients individually to ask them to delete the emails, and warned people to watch for messages impersonating Nikkei or its subsidiaries.
- Open questions: No threat actor has been named, and Nikkei hasn’t said whether the two incidents are connected.
- History: Nikkei disclosed a Slack breach last year affecting more than 17,000 employees and partners, a 2022 ransomware attack on its Singapore subsidiary, and a 2019 business email compromise that cost Nikkei America about $29 million.
Sergiu Gatlan broke down Nikkei’s disclosure for BleepingComputer, including the company’s earlier incidents.
Why one layer isn’t enough
Each control on its own can fail. Passwords get phished, MFA prompts get approved by mistake, and filters miss new links. Layers work because an attacker has to beat all of them, and each one gives you another chance to notice. The tools named below are examples only. Comparable options exist from many vendors, and the right mix depends on your business.
Layer 1: Make the login harder to steal
Phishing-resistant sign-in methods such as passkeys or hardware security keys, plus conditional access rules (for example in Microsoft Entra ID or a comparable identity platform), make a stolen password far less useful.
Layer 2: Notice a mailbox behaving badly
A normal employee doesn’t send thousands of messages in a burst. Outbound sending limits and alerts on unusual volume, new inbox rules, or sign-ins from unfamiliar locations can flag a takeover within minutes.
Layer 3: Clean up more than the password
After a compromise, sign the account out of every session, review forwarding rules and third-party app permissions, and check MFA settings for methods the attacker may have added. A password change alone can leave the door open.
Layer 4: Filter what reaches people
Email security with link checking, whether built into your mail platform or added from another vendor, can catch malicious URLs even when they come from a trusted internal sender.
Layer 5: Give people a simple verification habit
Staff and partners who confirm unexpected requests by phone or a separate channel stop many phishing and payment fraud attempts that slip past technology.
What this means for your company
- Assume a trusted sender can be the threat. Your customers and partners trust your email, and that trust is exactly what attackers borrow.
- Write a mailbox compromise playbook. List the steps: revoke sessions, reset credentials, check rules and app permissions, warn recipients, review logs.
- Cover every platform you use. Nikkei’s incidents hit both Google Workspace and Microsoft 365. Apply the same layered standard wherever your company has email or collaboration accounts.
Need help building layered protection around your Microsoft 365 or Google Workspace email? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
