27.3 How to Spot a Phishing Message

Safe habit: NEVER click a link in a message to log in.
Instead, open the bank/company site yourself by typing the address or using your saved bookmark.

Real incident: Nikkei – hacked employee email accounts used to send about 9,000 phishing emails (Oct 2026)

1. What happened

On Sunday 4 October 2026, the Japanese media group Nikkei disclosed two separate attacks on employee email accounts. In the first, an employee's Microsoft 365 account was taken over by an outsider, and on 30 September it was used to send about 9,000 spoofed emails with links to malicious websites. These went to Nikkei staff and to news sources and other contacts who had earlier written to several Nikkei employees. The names and email addresses of the recipients, and the content of some emails, may have leaked. Nikkei changed the password, saw no more unauthorised logins, asked the recipients to delete the emails, and reported the case to Japan's Personal Information Protection Commission. In the second case, an employee's Google Workspace account had been accessed from outside since late July; Nikkei learned about it in early August from a Google alert, and the names and email addresses of 1,646 employees and business partners may have been exposed. The group publisher Nikkei BP said separately that one of its employees' email accounts was accessed on 30 September after the password was stolen through a phishing email sent from a Nikkei employee's address. Nikkei has not said who was behind the attacks or whether the two cases are linked. Educational framing only.

2. How the hack happened (public reporting only – high-level)

1. The attacker got the login of one Nikkei employee's Microsoft 365 account (how is not public yet).
2. They logged in as that employee, so the mailbox, the contacts and the past conversations were all open to them.
3. On 30 September they used the real account to send about 9,000 emails with links to malicious websites, to colleagues and to people who already knew Nikkei staff.
4. Because the mail came from a real, known Nikkei address, our checklist point 1 (sender address) looked fine – the trust was borrowed.
5. At group publisher Nikkei BP, an employee's password was stolen through a phishing email sent from a Nikkei employee's address, and that second account was accessed the same day – one hacked mailbox led to the next.
6. Nikkei changed the password, and no more unauthorised logins have been seen since then.

3. How to stop it / defend (this lesson: spotting phishing)

• New rule for the checklist: a correct sender address is not proof. If a known person suddenly sends a link that asks you to log in, confirm with them by phone or chat before you click.
• MFA, preferably phishing-resistant (authenticator app with number matching, or passkeys / security keys), so a stolen password alone is not enough.
• Alerts on odd logins: new country, new device, or a login at an unusual hour should alert the security team – Google's alert is what exposed the second case.
• Limits on outgoing mail: one person's mailbox suddenly sending thousands of emails should be blocked automatically and checked.
• Clean up properly: after a takeover, sign out every session and remove unknown forwarding rules and app permissions – changing only the password is not always enough.
• Easy "Report phishing" button, so the first person who notices can warn everyone quickly (lesson 27.5).

4. How to take care so it won't happen again (checklist)

• [ ] Turn on MFA for every mailbox, including old and shared ones.
• [ ] Set an alert and a block for unusually large numbers of outgoing emails from one account.
• [ ] Review sign-in logs every week for new countries and new devices.
• [ ] Write a "mailbox hacked" playbook: reset password, sign out all sessions, check forwarding rules, warn the contacts.
• [ ] Teach staff: "a known name is not proof" – check by phone before clicking a login link, even from a colleague.
• [ ] India students: the same thing happens with hacked office Gmail and WhatsApp accounts sending "please check this file" links – verify on a call, and report incidents to CERT-In within the required time (see Ch.34).

Source: Nikkei Inc., "Regarding Information Leaks and the Sending of Suspicious Emails due to a Cyberattack", 5 October 2026 (Japanese notice 4 October 2026); BleepingComputer, Sergiu Gatlan, "Nikkei discloses breaches of employees' Microsoft, Google email accounts", 6 October 2026; The Record from Recorded Future News, "Japanese media group Nikkei discloses intrusions targeting employees and users", October 2026; Infosecurity Magazine, "Nikkei Discloses Two Employee Cloud Account Compromises", October 2026.

Check if you're safe: Phishing Link Checker