Osegi
Security·2 min read

Nitori Data Breach May Expose 37.62 Million Personal Records

Nitori Holdings says unauthorized access to its systems may have leaked up to 37.62 million personal records, including data on corporate members and online orders.

A Nitori furniture store exterior with a digital security warning overlay symbolizing a data breach.
Image: ITmedia NEWS
SUMODialoediviewergiftdetect

Nitori Holdings announced on November 9 that unauthorized access to a system it manages may have leaked as many as 37.62 million personal records. The company discovered the intrusion on November 6 and says attackers may have been inside its systems from mid to late October.

What may have been exposed

For customers and individual members of the Nitori Group, the data may include membership number, name, email address, address, phone number, date of birth and gender. For corporate members, it may include membership number, company name, department, the representative's name, the company's address and phone number, and the contact person's name, email address and phone number. Order data from the official online store Nitori Net and from Nitori's official shops inside e-commerce malls may also have been taken.

The combination of data differs from person to person. According to the company, login passwords and credit card information are not affected.

Response and next steps

On November 6 Nitori confirmed the unauthorized access and cut off the attacker. Later log analysis showed that a third party may also have accessed the systems in mid to late October. The company is still investigating the entry route and the scope of the damage, and the number of affected records may change.

Nitori says it has already fixed the vulnerable points and strengthened monitoring. It will keep working with outside specialists to determine the cause and whether any secondary damage has occurred, and it is reporting to and consulting with Japan's Personal Information Protection Commission and the police.

Affected people will be notified in stages by email or post. Because the leaked data could be used for impersonation emails, phishing scams and suspicious phone calls, Nitori urges customers to be wary of messages or calls that claim to come from Nitori or from delivery companies.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:nitoridata breachunauthorized accessjapanphishinge-commerce

More from this day

See all →

More in: Security

See all →