Key takeaways

  • Nitori Holdings, Japan's largest furniture and home goods retailer, says up to 37.62 million records of personal data on its servers may have leaked. It found the unauthorized access on November 6, and its log analysis shows possible access as early as mid to late October.
  • The data reaches well beyond account holders: individual members, people who bought without an account, corporate members, and orders placed through Nitori's shops on online malls.
  • Exposed details include names, addresses, phone numbers, emails, birth dates and gender, and for businesses, company and contact details. No passwords or card data were included.
  • Nitori says it has fixed a vulnerable point and blocked the attackers, but has not said what the weakness was or how the attackers got in.
  • It is the fourth-largest breach disclosed in Japan this year on our running list.

What happened#

According to Nitori Holdings' disclosure of November 9, it confirmed unauthorized access to a system it manages on November 6, blocked it, and began an investigation with outside specialists. Log analysis since then has found that a third party may have accessed the system before November 6, in mid to late October. Nitori says it has dealt with the vulnerable point, strengthened monitoring, and continues to block the attackers.

It has reported the incident to the Personal Information Protection Commission and is consulting the police. It will contact affected customers by email or post. It warns that the figure may change as log analysis and data matching continue.

What may have leaked#

Group Data
Individual members and people who bought from the Nitori group Member number, name (including the reading in kana), email, address, phone number, birth date, gender
Corporate members Member number, company name, department, representative's name, company address and phone number, contact person's name, email and phone number
Orders Orders placed through Nitori Net and Nitori's official shops on online malls

The combination differs by customer. The total is up to 37.62 million records, which is a count of records, not people. Login passwords and card data are not included.

Who is affected#

The list of groups is wider than a typical app or member breach:

  • People without an account. Nitori includes "purchasers" in the Nitori group alongside members. Someone who bought furniture once and gave a delivery address may be in the data.
  • Businesses. Corporate members' records include the company's representative and contact person, which makes them useful for business email compromise and invoice fraud as well as consumer phishing.
  • Online mall shoppers. Customers who ordered from Nitori's shop on an online mall dealt with the mall, not with Nitori's own site, but their order data is in scope. Nitori does not name the malls.

Nitori warns customers to watch for messages pretending to come from Nitori, delivery companies or online malls, and says it will never ask for passwords, card numbers or PINs by email or phone.

What we don't know yet#

  • How the attackers got in, and what the "vulnerable point" was
  • When the access began, and why it was not noticed until November 6
  • How many people the 37.62 million records represent, and how many are corporate members or mall orders
  • Which online malls are involved, and what order data includes, such as delivery addresses or items
  • Whether data was actually taken, or only may have been
  • Whether this is a ransomware or extortion case. As of November 9, we have not seen Nitori on leak sites tracked by ransomware.live

Our view#

One system held every channel's customers. Members, one-time buyers, businesses and orders from other companies' malls all appear in the same scope. Bringing every sales channel into one customer system is good for business, and it means one intrusion reaches all of them. The mall shoppers in particular may never have thought of themselves as Nitori's customers. Retailers should know which systems hold data from which channels, and whether every channel's history needs to sit where the member database is.

Up to three weeks unnoticed is the number to explain. Possible access from mid to late October, found on November 6, follows the pattern of this autumn's breaches: detection after the fact, then log analysis that pushes the start date back. Nitori says it will review access control, authentication, privilege management and monitoring. Saying which of those failed would help other retailers more than the list.

Expect the next wave at the login page. No passwords leaked here. But as MUJI found, a breach announcement draws attackers to the same brand, and credential stuffing with passwords from other leaks follows. Nitori's customers should not reuse passwords, and Nitori should tighten login protections now rather than after a second incident.

What this means for readers and practitioners#

  • If you have ever bought from Nitori, including through an online mall, expect messages that use your name, address and order history. Check any message about deliveries or refunds on Nitori's official site. See our guide on what to do after a breach notice.
  • Companies with Nitori corporate accounts should warn the named contact people about invoice and payment-change fraud.
  • Retailers should map which customer data each channel feeds into, and limit how much order history is kept in systems reachable from the internet.
  • Rate-limit logins and offer two-step sign-in as soon as a breach is announced, whether or not passwords were part of it.

Japanese terms at a glance#

Japanese Reading Meaning
個人会員 kojin kaiin Individual member
法人会員 hōjin kaiin Corporate member
購入者情報 kōnyūsha jōhō Purchaser information
ECモール ii shii mōru Online shopping mall (e.g. a marketplace)
注文情報 chūmon jōhō Order information
流出した可能性 ryūshutsu shita kanōsei May have leaked
脆弱箇所 zeijaku kasho Vulnerable point
ログ解析 rogu kaiseki Log analysis