Nitori says hackers may have taken up to 37.6 million customer records

The company says it found unauthorized access to a system it manages on Friday, November 6. It cut off the attacker right away and brought in outside security specialists.

What it found next: logs showed someone may also have gotten in earlier, between mid and late October. Nitori is still checking the details.

A log is a record of who touched a system and when. Here it is what let the company look backward and see that the break-in did not start on the day it was noticed.

Nitori is often called the "IKEA of Japan." It sells furniture, bedding and home accessories.

• Stores in Japan: 879
• Stores abroad: 219, across China, South Korea, Taiwan, Thailand, Singapore and Hong Kong
• Yearly revenue: about $5.8 billion

That reach explains the size of the number. A chain with this many stores and an online shop collects a lot of names over the years.

Nitori says the mix of data differs from person to person. The company lists three groups.

• Individual members and shoppers: membership number, name (including the phonetic reading), email address, postal address, phone number, date of birth and gender.
• Business members: membership number, company name, department, the representative's name, company address and phone, plus the contact person's name, email and phone.
• Orders: order details from Nitori Net, the company's online store, and from Nitori's official shops on online marketplaces.

The notice covers people who are not members too. Anyone who ordered through Nitori's stores or online shops may be in the data.

What is not included: Nitori says login passwords and credit card details were not part of it.

It is a lot, but read it carefully. Nitori counts records, not people.

A record is one row in a database. One person can have several rows, for example a membership and a separate order, so the number of affected people could be lower. The company has not said how many people that is.

The catch: the figure is also a maximum. Nitori says the system held up to 37.62 million records that may have been copied. It is still analyzing logs and matching data, and the count may change.

Fair question. No password and no card number sounds like good news, and it is better than the alternative.

But a name, an email, a phone number and a birth date are exactly what a scammer needs for phishing. Phishing means sending a fake message that looks real, to trick you into clicking a link or giving up a password.

If a message knows your name and says it is about your recent furniture order, it looks much more believable.

In real life You get a text that says a Nitori parcel could not be delivered, with a link to "reschedule." The text has your real name. Don't tap the link. Open the Nitori app or type the website address yourself instead.

Nitori warns about this itself. It says the data could be used for fake emails, phishing and suspicious calls. It lists messages that pretend to come from Nitori, a delivery company or an online marketplace.

Quite a bit. The company has not said how the attacker got in, so the cause is open. It also has not said whether the data was actually taken, only that it may have been copied.

Nitori says it has closed the weak spots and added more monitoring. After the investigation it plans to review how it controls access, handles logins and permissions, and watches its systems.

What's next: the company says it will contact affected customers by email or post, one by one. It has already reported the incident to Japan's Personal Information Protection Commission, the police and other authorities.

Yes, in a different way. In September 2022 Nitori said its app had been hit by a credential stuffing attack, which is when attackers take a big list of emails and passwords stolen from other websites and try them on a new site.

That attack began on September 15, 2022. About 132,000 accounts may have had personal information viewed.

The two cases are different. The 2022 one used passwords stolen elsewhere. The new one reached a system Nitori manages itself, and the company has not yet explained how.

Another Japanese home goods company reported its own breach just days ago. Iris Ohyama, which runs the Iris Plaza online store, said on October 29 that someone got into a third-party cloud service it uses.

• People possibly affected: about 7.7 million, made up of 5.8 million registered and former members and 1.9 million non-members
• Store status: the online shop was suspended on October 28 and was still down in early November
• Payments: card details were not stored in the affected service, the company says

These are two separate incidents. Nothing public connects Iris Ohyama and Nitori, and neither company has named an attacker.

Nitori found the break-in on November 6. If the first access was in mid-October, someone may have had a window of several weeks.

That is why the company says it is still checking. A short visit and a long one can leave very different amounts of data behind.

It also matters for you. Scam messages built from leaked data often appear weeks or months after a breach, not on the day of the announcement, so staying alert now is not a one-day job.

You do not need special tools. A few habits catch most fakes.

• Check the sender. A real company email comes from its own domain. Look at the full address, not just the display name.
• Watch for pressure. Messages that say your parcel will be returned today, or your account will close, want you to click before you think.
• Skip the link. Open the official app or type the website address yourself.
• Call back on a known number. If a caller says they are from a store, hang up and phone the number printed on the company's own site.

None of this depends on whether your data was in the leak. It works for any message that asks for something urgent.

• Treat Nitori-style messages with suspicion. Emails, texts or calls that mention Nitori, a courier or a marketplace order could be fake, even if they use your real name.
• Never share a password, card number or PIN. Nitori says it will never ask for these by email or phone.
• Wait for the official notice. Nitori says it will email or write to affected customers. Use the company's own website, not a link in a message, to check for updates.
• Business members, watch for fake invoices. Contact names and emails are in the data, so a message that pretends to come from a partner and asks you to change a payment account deserves a phone call first.