Nitori Holdings, one of Japan’s biggest home furnishings retailers, says an unknown intruder may have reached up to 37.62 million customer records on its systems. The company told the public on November 9 that passwords and credit card details were not part of it.[1][2] If you ever signed up as a Nitori member or ordered from its online shop, your name, address and email could now be in criminal hands, and that makes scam messages in your name far more convincing.Ad Fortect for WindowsGet a free scan and check if your PC is infected.Free scanTo use the full-featured product, you have to purchase a license for Fortect. The scan is free.Ad Fortect Mobile Security for Android and iPhoneBlock scam sites on your phone: its web protection stops known scam and phishing pages from opening.Get the appOpens Google Play or the App Store, where the vendor states the price.
What happened at Nitori
Nitori says it confirmed unauthorized access to its systems on Friday, November 6. A third-party investigation then placed the break-in between mid and late October, so the intruder had a window of roughly two to three weeks before anyone noticed.[1][3] The company says it has blocked the access and strengthened its monitoring, and it is working with outside cybersecurity experts to find out more.[2]
The sources I read do not say how the attacker got in, and none of them mention a group claiming the attack or a ransom demand.
How many people are affected
The headline number is 37.62 million, but it counts records, not individuals. Reports based on Kyodo news agency stress that one customer can appear in several records, so the count of real people is lower and has not been published.[3] The figure is also described as a ceiling. Nitori says up to that many records may have leaked, which is different from saying that every one was copied.
What data was exposed
Accounts differ a little on the details. A summary of Nitori’s own announcement lists names, contact details, addresses, birth dates, genders and order data.[2] The wire reports describe the exposed items more narrowly as the email and home addresses of Nitori group members and of people who bought goods online.[1][3] Because the company’s own list is the broadest, it is safest to assume the wider set of fields.
According to the company, account sign-in passwords and payment card details stayed out of the intruder’s reach.[1][3] That matters, because it means attackers cannot simply sign in to accounts or charge cards using what was taken. It does not make the data harmless, since a name plus a postal address plus an order history is exactly what a scammer needs to write a believable message.
What Nitori says about the data, by sourceItemReported statusNames and contact detailsMay have been exposed[2]Email and home addressesMay have been exposed[1][3]Birth dates, genders, order dataMay have been exposed[2]Login passwordsNot compromised[1][3]Credit card informationNot compromised[1][3]
How the Nitori incident unfolded, according to the company and news agencies. Sources: Star Media Group, Alo Japan.[1][3]
What Nitori says it is doing
Beyond blocking the intruder, the company has warned customers to expect phishing attempts and suspicious phone calls.[1][3] It says it will contact affected people by mail or email.[3] That last point is a trap in waiting. Criminals know a notification is coming, so fake notices are likely to arrive before or alongside the real ones.
Same week, another Japanese leak
Nitori was not alone that day. Game maker Sega said about 2.2 million customer email addresses leaked after a contractor that sends its newsletters, Arara Inc., was breached. Sega says names, phone numbers, card data and passwords were not included, and it has not confirmed any fraudulent use so far.[1][3] The two cases are separate.
What to do now
You do not need to change your Nitori password because it was not taken, but a few habits will protect you from the likely follow-up. Treat every message that mentions Nitori, a delivery, a refund or your account as suspect until you have checked it yourself.
Do not tap links in texts or emails about a Nitori order or account. Open the official app or type the website address yourself.If a caller claims to be from Nitori, a bank or the police and mentions your address or order, hang up and call the number printed on the official site.Never give out one-time codes, card numbers or passwords to anyone who contacts you first.Use a different password on every shop account, so a theft elsewhere cannot open this one.Watch your email for look-alike notices. The pattern is explained in our guide to the personal data has leaked email scam and the Take Immediate Action email scam.
A short routine for customers who think they may be in the data. Sources: Star Media Group, Alo Japan.[1][3]
Why a leak without passwords still matters
People often relax when they hear that no passwords or cards were taken. The danger here is social. A message that greets you by name and mentions your real address feels like it must be genuine. Fake account warnings like the Account Validation Request email scam use the same trick.
What comes next
Open questions remain: how many individuals are affected and how the intruder got in. The company is still investigating with outside experts, so details may change.[2] Customers should watch for the promised letters and emails.[3] When one arrives, do not use any link inside it. Go to the company’s website directly and compare what it says. The real number of people may turn out to be well below the record total.
——————————————————–
Click Here For The Original Source.
