Nitori, the Japanese furniture and home-goods retailer often called the “IKEA of Japan”, says an attacker accessed one of its systems and that up to 37.62 million records of personal information held on its servers may have leaked. BleepingComputer, which reported the news from the company’s notification (machine-translated), says the intrusion was detected on November 6 and that the access was blocked, while the company’s investigation indicates the attacker likely had access since mid-October. BleepingComputer describes Nitori as running 879 stores in Japan and 219 more across China, South Korea, Taiwan, Thailand, Singapore and Hong Kong.
Nitori says the company has blocked the attacker’s access, fixed vulnerabilities in its systems and strengthened monitoring. It has notified Japan’s Personal Information Protection Commission, the police and other authorities, and says it will tell affected customers directly by email or post. BleepingComputer says it asked Nitori questions and will update its article if the company replies. This is the latest large Japanese consumer breach we have covered, after Iris Ohyama and SEGA.
How to check if you’re affected
Affected products and services, as summarized by BleepingComputer from Nitori’s notice, cover individual members and purchasers, corporate members, and customers who placed orders through Nitori Net and official Nitori shops on e-commerce marketplaces. The exposed data may include:
- Individuals: membership number, name, email address, postal address, phone number, date of birth and gender.
- Corporate members: membership number, company, department and representative names, company address and phone number, and contact persons’ names, email addresses and phone numbers.
- Online orders: order information for purchases through Nitori Net and official Nitori shops on marketplaces.
Nitori says account passwords and credit card information were not exposed. It warns that the leaked data could be used in phishing and scam attempts, and that it will never ask customers for a password, credit card number or PIN by email or phone. Our suggestion, not Nitori’s: if you have bought from Nitori, treat unexpected messages that mention your name, address or order as suspect, and wait for the company’s direct notification rather than following links in an unsolicited message.