Nikkei Slack workspace accessed with credentials stolen by malware
Nikkei disclosed in early November 2025 that malware on an employee's personal computer had leaked the user's Slack credentials, which were then used to log in to the company's Slack workspace. Nikkei detected the unauthorized access in September 2025 and said data on up to 17,368 people may have been exposed.
- Victim
- Nikkei Inc.
- Industry
- Media and streaming
- Country
- Japan
- Intrusion began
- Sep 2025
- First disclosed
- Nov 4, 2025
- Actor
- Unattributed
- Initial access
- Stolen credentials
- Identity control that failed
- Credential storage
- MFA
- Not disclosed
- Abused identity
- Human account
- Records affected
- 17,368 (Employees and business partners whose names, email addresses and chat histories may have been exposed, per Nikkei.)
- Disclosed cost
- Not disclosed
The identity lesson
Credentials harvested from an unmanaged personal device were accepted as a normal login. Device-bound or managed-device-only access to corporate SaaS, plus phishing-resistant MFA, would have refused them.
Go deeper on SWI
Sources
- Nikkei Suffers Slack Breach After Employee PC Malware Infection, CyberInsider, Nov 4, 2025
- Nikkei's Slack breach leaks sensitive data from more than 17,000 users, Computerworld, Nov 6, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Disney Slack data theft using credentials stolen from an employee's personal computer 2024 · Stolen credentials
- Ticketmaster customer data stolen from its Snowflake account 2024 · Stolen credentials
- AT&T call and text records stolen from its Snowflake workspace 2024 · Stolen credentials
- Neiman Marcus customer data stolen from its Snowflake account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). Nikkei Slack workspace accessed with credentials stolen by malware. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-nikkei-slack-infostealer/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.