Nitori, a Japanese furniture retailer, said it confirmed on November 6 that an outside party had accessed a system it manages. Its investigation so far found that as many as 37.62 million personal records on its servers might have gone out. BleepingComputer reported the attacker likely had access since mid-October. Nitori said it blocked the access, fixed weak points and added monitoring.
Nitori said account passwords and credit card details were not exposed. The data that may have leaked includes names, contact details, birth dates, gender and online order information. On November 11, a spokesperson told BleepingComputer the company is still working out the cause and is checking if ransomware played a part. Nitori has not yet worked out how many customers are affected. The sources do not say which system was hit, how the attacker got in, or how many systems held the records.
A record count is not a customer count, so buyers cannot yet size their own exposure. Access that began in mid-October and ended on November 6 would have run for about three weeks unseen. Did the records sit in one system or several? Membership, contact and order data in one place would give an intruder a lot to take. Until Nitori says more, the question to ask any vendor is how fast it would notice odd access.