Japanese chain Nitori says an intrusion into its systems may have exposed 37.62 million records

Japanese furniture and home goods chain Nitori confirmed on November 6 unauthorised access by a third party to a system managed by the company, according to its notice cited by BleepingComputer. The investigation indicates that up to 37.62 million personal data records stored on its servers may have leaked, and that the attacker had likely had access since mid-October.

According to that notice, the affected data may include membership numbers, names, email addresses, postal addresses, phone numbers, dates of birth and gender of individual customers, contact details of corporate members and orders placed in its online store. The company says passwords and card data were not affected.

Nitori says it blocked the access, fixed the vulnerabilities and informed Japan's Personal Information Protection Commission and the police, and warns that the data could be used for fraud or impersonation attempts. A spokesperson told BleepingComputer they are still investigating the cause, including whether ransomware was involved, and have not determined how many customers are affected.

Developing story: the details come from a single specialist outlet citing Nitori's notice; the company's original statement could not be opened, and the cause and the real number of people affected remain unknown.