The recent cybersecurity incident involving Japanese furniture giant Nitori highlights a growing concern for enterprises: protecting passwords and payment information is not enough when millions of customer records remain vulnerable to unauthorised access.

Nitori has disclosed that attackers may have accessed up to 37.62 million records of personal information, including customer names, addresses, telephone numbers, email addresses, dates of birth, membership information and purchase-related details.

Although the company confirmed that passwords and credit card information were not included in the potentially exposed data, the incident still represents a serious privacy and security risk.

What makes this particularly concerning is that personal information can be extremely valuable to cybercriminals even without financial credentials.

Names, contact details, addresses and purchase histories can be exploited to create convincing phishing emails, fraudulent delivery notifications, impersonation attempts and other targeted scams.

For enterprises, this raises an important question: Are organisations protecting customer information throughout its lifecycle, or primarily focusing on securing the applications through which customers interact with them?

Modern businesses collect and retain enormous volumes of customer information across websites, mobile applications, databases, cloud platforms and third-party integrations. Every system holding that information represents a potential security exposure.

This incident reinforces the importance of Data Loss Prevention (DLP), Zero Trust access, application and API security, behavioural anomaly detection and continuous monitoring of sensitive data access.

Organisations must ensure that users and applications can access only the information necessary for their legitimate business activities. Unusual database queries, excessive data retrieval and unexpected transfers of sensitive information should be investigated promptly.

Equally important are data minimisation, appropriate retention policies, encryption and regular reviews of access privileges.

The larger cybersecurity lesson is that preventing unauthorised access is only one part of protecting customer information. Enterprises must also detect suspicious data activity and limit the amount of information that can be exposed when a security control fails.

Because even when passwords remain secure, stolen personal information can continue putting customers at risk long after the original breach.

Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. [...]

Source: Japanese furniture giant Nitori says hackers stole 37.6M customer records via Bleeping Computer — published 10 Nov 2026.