Nitori Holdings is Japan's largest furniture and homewares retailer. On Monday, November 9, it said personal data in up to 37.62 million customer records may have been taken from systems it manages. The company published the notice to customers and also filed it with the Tokyo Stock Exchange. Nitori confirmed unauthorised access by an outside party on Friday, November 6, and cut it off. Later log analysis suggests the attackers may have been inside earlier, from mid to late October. The exposed data includes names, home and email addresses, phone numbers, dates of birth, corporate contact details and online order data. Nitori says login passwords and credit card details were not included. No group has claimed the attack, and the company has not named an attacker.
What Happened
Nitori detected unauthorised access to one of its systems on November 6. It blocked the access that day and brought in outside cybersecurity specialists. CyberSIXT and BigGo Finance both describe this sequence from the company's notice. As the investigation went on, log analysis showed that the same party may also have had access between mid and late October. Kyodo News, as carried by The Straits Times and The Mainichi, describes the October window as what a third-party investigation found. The company's own wording is more cautious: it says it is still investigating how the attackers got in and how long they were inside.
The size of the breach is reported in three ways. The company's notice gives a maximum of 37.62 million records, and CyberSIXT, TipRanks, BigGo Finance and Japanese outlet Security Measures Lab repeat that figure. Kyodo's headline rounds it to 38 million. FilingReader's automated summary of the stock exchange filing says "3.762 million accounts." That figure looks like a conversion error: the Japanese figure, 3,762万, means 37.62 million. Every other report, including Kyodo's, uses 37.62 million.
Nitori has also been clear that 37.62 million is a maximum, not a final count. Security Measures Lab points out that the figure counts records, not people. It does not mean 37.62 million individuals were affected, or that every record actually left the network. The company says the number may change as it matches logs against its data. It has not said how many individual people the records represent.
Nitori has reported the incident to Japan's Personal Information Protection Commission and to the police. According to FilingReader's summary of the filing, Nitori expects the effect on its consolidated business results to be limited. Security Measures Lab reports that the disclosure was filed with the exchange at 17:20 local time on November 9.
What Was Taken
What was exposed depends on the type of customer, and Nitori says the mix of data differs from one record to the next:
- Individual members and purchasers of the Nitori Group: member number, name and its phonetic (kana) reading, email address, postal address, phone number, date of birth and sex.
- Corporate members: member number, company name, department, the representative's name, company address and phone number, and the named contact person's name, email address and phone number.
- Online order data: orders placed through Nitori Net, the company's own online store, and through Nitori's official shops on third-party e-commerce marketplaces.
Nitori says login passwords and credit card information were not affected. Security Measures Lab notes that the notice does not say which fields each order record contained. It is therefore not known whether item details or order values were exposed.
The direct financial risk is low. The bigger risk is identity data. Name, date of birth, home address, phone number and email together are enough to build convincing impersonation and phishing lures. Adding real purchase history makes those lures much more believable.
Why It Matters
Scale. At up to 37.62 million records, this is one of the largest retail data exposures Japan has seen. Even after duplicates and inactive accounts are removed, it probably covers a large share of Japanese households.
Order data enables targeted fraud. An attacker who knows what a customer recently bought can send fake delivery, refund or "problem with your order" messages that reference real transactions. Nitori itself has warned customers about phishing emails and suspicious phone calls.
Corporate contacts open the door to invoice fraud. Corporate member records name departments and contact people. Security Measures Lab warns that this information could be used for business email compromise, such as fake payment, delivery or bank-detail change requests made to look like they come from Nitori or a real business partner.
Part of a wider run of Japanese breaches. Kyodo reported that on the same day, Sega disclosed a leak of about 2.2 million customer email addresses through Arara Inc., a contractor that sends Sega's newsletters. CyberSIXT also reported on November 9 that SMBC Consumer Finance had disclosed a breach affecting up to 320,118 bank loan customers. Japanese consumers and businesses now face phishing risk from several data sets at once, and those data sets could be combined.
The Attack Technique
Nitori has not said how the attackers got in. Its only technical statement is that it has fixed the weak point the attackers used and strengthened monitoring. It has not said whether that weak point was a software vulnerability, a misconfiguration, stolen credentials or a supplier's access.
The timeline does tell defenders something. The access detected on November 6 appears to have been preceded by earlier access in mid to late October that was not noticed at the time. That means the attackers may have been inside for two to three weeks before detection. The earlier activity was found only by looking back through logs after the November alert. Nitori has not said whether the October activity was the first break-in or reconnaissance before the data was taken.
No ransomware group or other actor has claimed the attack. The company has not mentioned encryption, ransom demands or disruption to its systems.
What Organizations Should Do
- Warn customers before the phishing starts. If your customer data overlaps with Nitori's, which is likely for any large Japanese consumer brand, tell customers what your company will and will not ask them for. Phishing based on this data is likely to reference real orders and deliveries.
- Check payment and bank-detail change requests through a second channel. Accounts payable and procurement teams that deal with Nitori, or with any supplier whose contacts may now be exposed, should confirm changes by calling a number already on file, not one given in the request.
- Keep logs long enough to look back. Nitori found the October access only by reviewing older logs. Keep authentication, database query and data export logs for at least 90 days, and make sure you can search them quickly.
- Alert on large data exports. Exporting tens of millions of records produces unusual query volumes and outbound traffic. Set baselines for normal reads from customer databases and alert on bulk exports, especially from systems that serve web storefronts.
- Hold less data and keep it separate. Corporate contacts, consumer profiles and marketplace order data apparently sat within reach of a single compromised system. Keep these data sets in separate systems, and delete records for long-inactive customers.
- Treat marketplace and storefront integrations as part of your attack surface. Order data from third-party marketplace shops was among the exposed data. Review the credentials, API access and monitoring for every system that combines orders across channels.
Sources: Nitori says attackers may have taken 37.62 million customer records | Nitori says 38m customer records leaked in breach The Straits Times | Nitori Reports Potential Exposure of 37.62 Million Customer Records... | Japan's Nitori Holdings Hit by Unauthorized Access; Up to 37.62 Mil... | ニトリに不正アクセスによるサイバー攻撃、最大3,762万件の個人情報漏洩の恐れ-ニトリネットやECモールなどの法人会員・購入者の情報も... | CyberSIXT reporting: original cybersecurity news | Nitori Holdings reports potential data leak affecting millions | Home retailer Nitori says up to 38 mil. customer records may have l...