Nitori says attackers may have taken 37.62 million customer records

Nitori Holdings, Japan's largest furniture and homeware retailer, says personal data in up to 37.62 million records may have been taken from its servers. In a notice to customers on Monday, also filed with the Tokyo Stock Exchange, the company said it confirmed unauthorised access by a third party to a system it manages on Friday, November 6, cut the access off and brought in outside specialists.

Log analysis since then shows the attackers may have had access earlier, from mid to late October. Nitori says it is still investigating how they got in and how long they were there, and that the number of records may change as it matches logs against its data.

What may have been taken

The records cover members of Nitori's group loyalty programme and people who bought from the group, with member number, name and its kana reading, email address, postal address, phone number, date of birth and sex. For business members they include the company name, department, the representative's name, company address and phone number, and the contact person's name, email address and phone number. Order data from Nitori Net, the company's own online store, and from Nitori's official shops on e-commerce marketplaces is also included.

The combination of data differs from customer to customer. Login passwords and credit card details were not among the data that may have been taken, Nitori says. It has not said how many individual people the 37.62 million records represent.

What Nitori is doing

The company says it has fixed the weak point the attackers used and tightened monitoring, and will contact affected customers by email or post. It has reported the incident to Japan's Personal Information Protection Commission and the police. It warns customers to expect phishing emails, texts and calls from people posing as Nitori, delivery companies or e-commerce marketplaces, and says it never asks for passwords or card numbers by email or phone. Customers with questions can use its dedicated inquiry form.

What is not known

Nitori has not said which system was breached, how the attackers got in, or whether it has received a ransom demand. No group has publicly claimed the attack.