Nitori Holdings said on November 9 that unauthorized access to its systems may have exposed up to 37.62 million pieces of personal information, including data on corporate members of its loyalty and shopping programs.
The company confirmed the breach on November 6. It also found signs that a third party may have had access in mid-to-late October, based on a later analysis of logs.
Nitori blocked the attacker's access when it confirmed the intrusion. It says it is still investigating how the attacker got in and how far the damage reaches, so the number of records may change.
What may have leaked
The data potentially exposed covers people who bought Nitori Group products and individual members. It includes membership numbers, names, email addresses, home addresses, phone numbers, dates of birth and gender.
For corporate members, the exposed fields include membership numbers, company names, department names, representative names, company addresses and phone numbers, and the names, email addresses and phone numbers of staff in charge.
Order data from Nitori Net, the company's official online store, and from official Nitori shops on e-commerce marketplaces may also have leaked.
Which fields apply varies by person. Login passwords and credit card information are not affected.
Response and warnings
Nitori says it has fixed the vulnerable points and strengthened its monitoring. It will keep working with outside specialists on the cause and on whether any secondary damage has occurred.
The company is also reporting to and consulting the Personal Information Protection Commission and police. It plans to contact affected people in turn by email or post.
Nitori warned that leaked data could be used for impersonation emails, phishing scams or suspicious phone calls. It urged customers to be wary of contact from anyone posing as Nitori or a delivery company.