On October 4, 2026, the Japanese media group Nikkei disclosed two separate compromises of employee email accounts, incidents that read like a controlled demonstration of the hardest problem in email security today. An attacker gained access to a real Microsoft 365 mailbox and, on September 30, used it to send approximately 9,000 phishing emails containing links to malicious websites. The recipients were not strangers. They were Nikkei staff and interviewees the company’s journalists had been in contact with, precisely the people most likely to trust a message from a Nikkei address.
The disclosure, reported by BleepingComputer, The Record and Infosecurity Magazine, also covered a second, earlier incident. A Google Workspace account belonging to another employee was accessed from late July 2026. Nikkei learned of that intrusion in early August after a notification from Google and changed the account’s password, but the company said the exposure may have included the names and email addresses of 1,646 individuals, mainly employees and business partners. Nikkei reported the incidents to Japan’s Personal Information Protection Commission, has not attributed them to any specific actor, and has not confirmed whether the two intrusions are connected.
The detail that should stop every email admin
The phishing wave of September 30 was not spoofing in the classic sense. Nobody forged a From header or tried to dodge SPF or DKIM. The messages were sent through a genuine Nikkei Microsoft 365 account, which means they were signed and aligned with the company’s own domain. SPF passed. DKIM passed. DMARC passed. Every authentication signal that a receiving mailbox provider checks was green, because from the protocol’s point of view, this was legitimate Nikkei mail.
That is what makes lateral phishing from a compromised mailbox so dangerous. Authentication proves the message came from the domain in the From line. It says nothing about whether the person holding the mailbox is the person who should be holding it. Nikkei contacted recipients and asked them to delete the messages, but the company also warned that the names, email addresses and parts of email bodies of the recipients may have leaked. Sister publisher Nikkei BP disclosed that one of its own employees lost credentials on September 30 to a phishing email sent from a Nikkei employee’s address, potentially exposing another 26 names and email addresses. One compromised mailbox created the next compromise within days, exactly the chain reaction that business email compromise attackers rely on.
What DMARC can and cannot do here
It is tempting to read this story as evidence that DMARC does not matter, because a fully enforced policy at p=reject would not have blocked a single one of those 9,000 messages. That reading is wrong in a specific and important way.
What DMARC cannot do is authenticate humans. It authenticates domains. When an attacker owns a real mailbox inside your tenant, the mail that mailbox produces is yours, and no policy in DNS changes that. The defenses that matter in that scenario are identity controls: phishing resistant MFA, conditional access policies, session revocation, detection of suspicious inbox rules and forwarding, and monitoring of OAuth grants. Nikkei’s incident is a reminder to fund those controls, not to skip authentication.
What DMARC and its reporting still do for you in a lateral phishing event is twofold. First, enforcement closes the cheaper attack path next to this one. Attackers who cannot get into a mailbox fall back on lookalike domains and exact domain spoofing, and those attempts are exactly what a p=reject policy and your aggregate reports expose from the first message. Second, continuous report monitoring gives you a live inventory of every source sending as your domain. When a security team investigates a suspected account takeover, the question that matters first is whether the sending patterns from that mailbox are normal. Teams that read their DMARC reports daily know what normal looks like for every legitimate source, which is how anomalies like a sudden 9,000 message burst from one user surface fast.
The journalist’s paradox
There is a sector specific angle worth naming. News organizations run on contact with people who have every reason to expect privacy: sources, whistleblowers, interviewees. Nikkei said the recipients of the phishing wave included people its journalists had been in contact with, and that names, email addresses and parts of email bodies may have leaked. For a media company, a mailbox compromise is not only a security incident, it is a source protection incident. The same is true for law firms, healthcare providers and financial advisors, all of whom hold correspondence whose exposure harms third parties more than the company itself.
That raises the stakes on the boring work of email authentication. Internal phishing simulations, employee education about credential harvesting, and tight tenant policies on mail forwarding are part of the source protection program, not just the security program.
What to take away
Nikkei’s disclosure is the clearest recent example that authentication is the floor, not the ceiling. A hijacked mailbox turns your own good authentication posture into an asset for the attacker, and nothing in SPF, DKIM or DMARC changes that. But the answer is not to treat domain authentication as solved and irrelevant. The answer is to treat it as the base layer that eliminates spoofing, keeps your aggregate reports full of ground truth about who sends as you, and frees your team’s attention for the harder problems: identity, sessions, and behavior inside the tenant.
Every compromised mailbox is surrounded by signals, from anomalous sending volume to unfamiliar sources in your authentication data. Excello Mail turns your DMARC, SPF and DKIM reports into a live view of everything sending as your domain, so you know your legitimate baseline and can spot what breaks it. Sign up for free to Excello Mail and see who is really speaking for your domain.