According to the company's disclosure, the breached accounts were tied to Microsoft and Google email services. The incident was announced over the weekend, with Nikkei stating the attackers gained unauthorized access to the accounts before leveraging one of them to distribute the phishing messages.

The company has not released details on how the accounts were initially compromised, nor has it specified the exact number of phishing emails sent beyond "thousands." It is also unclear whether any recipients interacted with the malicious messages.

Nikkei's disclosure follows a pattern of recent attacks targeting media organizations and corporate email systems, where compromised accounts are used to lend legitimacy to phishing campaigns. Such attacks often bypass traditional security filters because the messages originate from trusted internal accounts.

Affected services:

• Microsoft email accounts
• Google email accounts

There is no indication yet of whether customer data or other internal systems were impacted beyond the two employee accounts. Nikkei has not publicly named a threat actor or attributed the breach to any specific group.

Source: Unknown

Does your organization have additional protections in place for employee email accounts, or do you rely solely on the provider's built-in security?