Japanese furniture giant Nitori says hackers stole 37.6M customer records
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records.
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records.
The intrusion was detected on November 6, and the company blocked the unauthorized access; however, an investigation into the incident revealed that the attacker likely had access to the system since mid-October.
The company warned potentially impacted customers that the compromised information could be leveraged in phishing attacks and scamming attempts against, and urged them to exercise caution.
According to the company's notification, the incident impacts individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops.
The potentially exposed information may include the following data types: The company specified that account passwords of registered members and credit card information were not exposed in this incident.
Nitori says it promptly blocked the attacker’s access, addressed vulnerabilities in its systems, and strengthened threat monitoring to prevent similar incidents in the future.
Nitori has informed Japan’s Personal Information Protection Commission, the police, and other relevant authorities, and has promised to notify affected customers directly by email or post.
Update 11/11 - A Nitori spokesperson told the outlet that they are currently investigating the cause, including whether ransomware was involved, and cooperate with external cybersecurity experts.
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
BleepingComputer has contacted Nitori with questions about the incident, and we will update this post when we get a reply.
What happened
Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records.
The intrusion was detected on November 6, and the company blocked the unauthorized access; however, an investigation into the incident revealed that the attacker likely had access to the system since mid-October.
What changed
The company warned potentially impacted customers that the compromised information could be leveraged in phishing attacks and scamming attempts against, and urged them to exercise caution.
Who is affected
According to the company's notification, the incident impacts individual customers, corporate members, and non-members who placed orders through official Nitori stores and online shops.
The potentially exposed information may include the following data types: The company specified that account passwords of registered members and credit card information were not exposed in this incident.
Why it matters
Nitori says it promptly blocked the attacker’s access, addressed vulnerabilities in its systems, and strengthened threat monitoring to prevent similar incidents in the future.
Nitori has informed Japan’s Personal Information Protection Commission, the police, and other relevant authorities, and has promised to notify affected customers directly by email or post.
Technical details
Update 11/11 - A Nitori spokesperson told the outlet that they are currently investigating the cause, including whether ransomware was involved, and cooperate with external cybersecurity experts.
Nippon Columbia malware incident exposes 8.6 million karaoke fan records
Response
BleepingComputer has contacted Nitori with questions about the incident, and we will update this post when we get a reply.
What to watch next
Watch for revised vendor guidance, fixed versions and mitigation updates.