Nitori Holdings, Japan's largest furniture and home goods retailer, says up to 37.62 million records of personal data may have leaked after unauthorized access to a system it manages. The company disclosed the incident on 9 November, saying it confirmed the unauthorized access on 6 November and blocked it.

Log analysis since then has found that a third party may have accessed the system before 6 November, in mid to late October. Nitori says it has dealt with the vulnerable point, strengthened monitoring and continues to block the attackers, but it has not said what the weakness was or how the attackers got in.

Members, guest buyers and mall orders in scope

The data reaches well beyond account holders. It covers individual members, people who bought without an account, corporate members and orders placed through Nitori's shops on online malls. Exposed details include names, addresses, phone numbers, emails, birth dates and gender, and for businesses, company and contact details. Login passwords and card data were not included, and the 37.62 million figure is a count of records, not people.

Nitori has reported the incident to Japan's Personal Information Protection Commission and is consulting the police. It will contact affected customers by email or post, and warns them to watch for messages pretending to come from Nitori, delivery companies or online malls. Japan Cyber Watch ranks the incident the fourth-largest breach disclosed in Japan this year.