When Japanese publishing giant Nikkei disclosed last weekend — as reported by BleepingComputer — that attackers carried out an email account breach on two employees and used one mailbox to send 9,000 phishing emails, it laid bare a lesson every business should already know: one compromised mailbox is enough to turn your own domain into a phishing launchpad.
For South Florida businesses, this is not a distant news story. It is a playbook your attackers already use — break into one real account, then send believable phishing from a legitimate address your customers and vendors already trust.
What Happened: A Timeline of the Email Account Breach
Nikkei — the media company that owns the Financial Times and the world’s largest financial newspaper — reported two separate incidents. The first was a Google Workspace account accessed in late July, discovered in early August after a notification from Google, exposing the names and email addresses of 1,646 employees and business partners.
The second was more damaging. In September, attackers accessed an employee’s Microsoft 365 account and used it to send 9,000 phishing emails targeting Nikkei staff and interviewees. On September 30, emails with links to malicious websites went out from a legitimate corporate address.
Nikkei changed the passwords, confirmed no unauthorized logins since, and contacted recipients individually to ask them to delete the messages. The company has not yet attributed the attacks or confirmed whether the two incidents are connected.
Why This Email Account Breach Matters to Your Business
The dangerous part is not that a password was stolen. It is what happened after: the attacker used a trusted mailbox to launch a second wave of attacks from inside the building, so to speak.
This is the core of modern business email compromise, and the reason this email account breach is worth studying closely. A phishing email sent from a random Gmail address is easy to spot. The same email sent from yourname@yourcompany.com — or from a vendor’s real domain — slips past both spam filters and human suspicion. Nikkei’s own staff and contacts were the target, and the sender address looked legitimate because it was.
Nikkei is far from the first. Last year the company disclosed a Slack breach affecting more than 17,000 people. In 2019 it lost about $29 million in a business email compromise targeting a Nikkei America employee. The pattern repeats because the defense is hard and the payoff is high.
How Attackers Turn One Account Into an Email Account Breach Amplifier
The sequence is consistent across industries. First, an attacker obtains credentials — through a phishing link, a reused password from a prior breach, or a credential-stuffing attack. Then they sign in, often during quiet hours, and study the mailbox to learn who talks to whom and how invoices and payments flow.
Finally, they weaponize the account, which is what turned a single email account breach into a nine-thousand-message phishing wave. They send mass phishing to the victim’s contact list, or they launch narrowly targeted messages to specific executives or customers. Either way, the messages originate from a real account with real history, which defeats most technical filters and much of the human caution that would normally apply.
Multi-factor authentication blunts the first step of an email account breach, but it is not a guarantee — session cookies, push-fatigue attacks, and SIM-swapping can all bypass MFA. That is why detection matters as much as prevention.
6 Ways to Protect Your Business from an Email Account Breach
- Enforce MFA everywhere. Every mailbox, not just executives. Use phishing-resistant methods like hardware keys or app-based authentication where possible.
- Kill reused passwords. A password stolen from one unrelated site is how many of these breaches start. A password manager and unique credentials close that door.
- Watch for impossible travel and odd sign-ins. Microsoft 365 and Google Workspace both log login locations and devices. Review them, and configure alerts for anomalies.
- Monitor outbound mail volume. An account suddenly sending hundreds or thousands of messages is a red flag. Set sending limits and alerts so the blast radius stays small.
- Train staff to question internal email too. “It came from a coworker’s address” is no longer proof of legitimacy. Verify unusual requests by phone or a second channel.
- Have an incident plan. Know who resets the account, who notifies recipients, and how you tell customers before a breach forces your hand.
For South Florida businesses, the takeaway is simple: treat every mailbox as an attack surface, not just a place messages land. If you would like a second set of eyes on your email security posture, talk to our team about cybersecurity services for South Florida businesses, or book a consultation to review your configuration.
Frequently Asked Questions
What is an email account breach?
It is unauthorized access to a mailbox, usually through stolen credentials. Once inside, attackers read, send, and redirect email — often to launch phishing or fraud against the victim’s own contacts.
How did one account send 9,000 phishing emails?
The attacker signed into a legitimate Microsoft 365 account and used it as the sending address, so the messages appeared to come from a trusted source and bypassed many filters.
Does multi-factor authentication stop an email account breach?
It stops the most common credential attacks, but not all — attackers also use stolen session cookies and MFA fatigue. Detection and outbound monitoring are equally important.
What should I do if my business email is compromised?
Reset the password immediately, revoke all active sessions, enable or re-verify MFA, notify anyone who received suspicious messages, and check for mail-forwarding rules the attacker may have left behind.
Source: BleepingComputer, “Nikkei discloses breaches of employees’ Microsoft, Google email accounts,” October 6, 2026.