Nitori, a major Japanese furniture and home-goods retailer, said on November 10 that an unauthorized party accessed a system on its network and may have taken up to 37.62 million customer records. The company detected the intrusion on November 6 and blocked the access, but its own investigation found the attacker likely had a foothold since mid-October. That is a three-week house visit at a company that sells hundreds of thousands of storage solutions, and it found the one cabinet nobody locks.
The scale is worth stating plainly. Nitori operates 879 stores in Japan and another 219 across China, South Korea, Taiwan, Thailand, Singapore, and Hong Kong, with annual revenue of roughly $5.8 billion. The potentially exposed data includes membership numbers, names, email addresses, postal addresses, phone numbers, dates of birth, and gender for individual customers; comparable fields for corporate members; and order information from its online shops. The company says account passwords and credit card information were not exposed. Thirty-seven point six million loyalty records is enough to address a holiday card to a third of Japan, which until this week was a marketing goal rather than a threat model.
Nitori notified Japan’s Personal Information Protection Commission and the police, and says it will contact affected customers directly by email or post. As of November 11, a spokesperson told reporters the company is still investigating the cause, including whether ransomware was involved, is working with external cybersecurity experts, and has not finalized the number of customers impacted. The published figures are ceilings, and every number in this story is one the company itself disclosed.
For ordinary companies, the operational lesson is in the calendar, not the record count. Three weeks between intrusion and detection is what dwell time looks like, and membership and CRM databases are exactly where attackers go first because the rows are pre-packaged for the second wave: phishing that references a real order, a real address, and a recent purchase. Nitori itself is warning customers about phishing and scam attempts, and says it will never ask customers for passwords, card numbers, or PINs by email or phone. That sentence, from the breached company to its own customers, is now the most valuable line on its website.
The advice side is boring and works. Know where your customer table lives and who can read it in bulk, because 37 million rows do not leave a network quietly or individually. Alert on large exports. Segment the membership system from the sales floor’s open Wi-Fi. Treat any credential that has been valid since mid-October as compromised. Count your sticks before the flood, because a company that cannot say how many customer records it holds will get its first published number wrong, at deadline, in front of a regulator.
If you are a Nitori customer: expect polite, personal, completely fabricated email about furniture, and type the retailer’s URL into your browser instead of clicking. The attackers now know where you live, when your birthday is, and what you think a living room should look like. It is the most intimate data a furniture company can leak, and the least recoverable.
Sources
Original reporting — the facts belong to their owners; the opinions and rodents are ours.