[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6_pEFnUHHuU-ZrTP10jGgPYfNjGK6Rgg9Hdjg3h__-I":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"6acf9b09-405d-491b-8289-04c7dcd4946a","Japanese furniture giant Nitori says hackers stole 37.6M customer records","japanese-furniture-giant-nitori-says-hackers-stole-37-6m-customer-records-e01c8b","Nitori, a major Japanese furniture and home accessories retailer, discovered that an attacker accessed a system on its network and may have stolen 37.62 million customer records. [...]","Japanese furniture retailer Nitori has disclosed a data breach where hackers accessed a system and potentially stole 37.62 million customer records. The unauthorized access was detected on November 6, with the attacker likely having access since mid-October. The exposed data includes membership details, names, contact information, and order history, but not account passwords or credit card information. Nitori has notified relevant authorities and affected customers, and has taken steps to address vulnerabilities and enhance security monitoring.","Japanese retailer Nitori reports data breach affecting 37.6M customer records.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fjapanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F10\u002Fnitori.jpg","2026-11-10T20:54:55+00:00","2026-11-10T21:00:12.941253+00:00",7,[17],{"name":18,"type":19},"Nitori","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":20,"icon":22,"name":23,"slug":24},null,"Breaches","breaches",[26,28,33,38],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":22,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":46,"vendors":134},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"omada","Omada","\u002Fvendor-logos\u002Fomada.png","omada-identity-cloud","Omada Identity Cloud","https:\u002F\u002Fomadaidentity.com\u002Fproducts\u002Fomada-identity-cloud\u002F","Identity governance and administration delivered as a service.",{"slug":77,"name":78,"problem":79,"products":80},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"vega","Vega","\u002Fvendor-logos\u002Fvega.png","vega-agentic-detection","Agentic Detection","https:\u002F\u002Fvega.io\u002Fplatform\u002Fagentic-detection","Detection rules that run across security data in the stores where it already lives, so logs do not have to be moved into a central SIEM first.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"slug":106,"name":107,"problem":108,"products":109},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[110,118,126],{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","purview-dlp","Microsoft Purview Data Loss Prevention","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fdata-security-governance\u002Fmicrosoft-purview-data-security","Data classification and loss prevention across Microsoft 365, endpoints and connected cloud apps.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"376m-nitori-customer-records-stolen-after-weeks-of-undetected-access","37.6M Nitori Customer Records Stolen After Weeks of Undetected Access","Hackers gained unauthorized access to Nitori's systems in mid-October and went undetected for roughly three weeks before discovery on November 6, ultimately exfiltrating 37.62 million customer records. The extended dwell time suggests inadequate real-time monitoring and alerting on sensitive data stores. While passwords and payment card data were not exposed, the scale of personal information stolen — names, contact details, membership data, and order history — creates significant risk for phishing, identity theft, and social engineering attacks against affected customers. This incident highlights how even partial data breaches at retail scale can cause enormous downstream harm to millions of individuals.",[140,141,142,143,144],"NIST CSF 2.0 DE.CM-01: Monitoring of networks and systems","CIS Control 13: Network Monitoring and Defense (v8)","NIST SP 800-53 AC-6: Least Privilege","GDPR Article 32","NIS2 Article 21(2)(i)",{"GDPR Article 32":146,"NIS2 Article 21(2)(i)":147,"NIST SP 800-53 AC-6: Least Privilege":148,"CIS Control 13: Network Monitoring and Defense (v8)":149,"NIST CSF 2.0 DE.CM-01: Monitoring of networks and systems":150},"Article 32 requires organizations to implement appropriate technical measures — including monitoring and access controls — to ensure security of personal data, all of which were insufficient to prevent or promptly detect this breach.","This point requires adequate access control and asset management policies, the absence of which allowed an attacker to access sensitive customer data systems without triggering timely detection.","Applying least privilege to database access would have restricted which accounts or services could read large volumes of customer PII, limiting the attacker's ability to exfiltrate data at this scale.","This control requires monitoring network traffic and data flows to detect exfiltration events, which would have identified the large-scale theft of customer records before it reached 37.6 million entries.","Continuous monitoring of systems and networks would have flagged the abnormal bulk access to 37 million customer records far earlier than the three-week dwell time observed."]