Japanese furniture giant Nitori says hackers stole 37.6M customer records
Japanese retailer Nitori reports data breach affecting 37.6M customer records.
Japanese furniture retailer Nitori has disclosed a data breach where hackers accessed a system and potentially stole 37.62 million customer records. The unauthorized access was detected on November 6, with the attacker likely having access since mid-October. The exposed data includes membership details, names, contact information, and order history, but not account passwords or credit card information. Nitori has notified relevant authorities and affected customers, and has taken steps to address vulnerabilities and enhance security monitoring.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Nitori?
Get an email when a new story names Nitori, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonHackers gained unauthorized access to Nitori's systems in mid-October and went undetected for roughly three weeks before discovery on November 6, ultimately exfiltrating 37.62 million customer records. The extended dwell time suggests inadequate real-time monitoring and alerting on sensitive data stores. While passwords and payment card data were not exposed, the scale of personal information stolen — names, contact details, membership data, and order history — creates significant risk for phishing, identity theft, and social engineering attacks against affected customers. This incident highlights how even partial data breaches at retail scale can cause enormous downstream harm to millions of individuals.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.