[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f4WpzurozTRhhcXmFtoAOdADZ-4V9gsDT8jxRkPAUULY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":50},"f63d809e-bc2e-49ff-87fc-1b101380ed82","376m-nitori-customer-records-stolen-after-weeks-of-undetected-access","6acf9b09-405d-491b-8289-04c7dcd4946a","37.6M Nitori Customer Records Stolen After Weeks of Undetected Access","Hackers gained unauthorized access to Nitori's systems in mid-October and went undetected for roughly three weeks before discovery on November 6, ultimately exfiltrating 37.62 million customer records. The extended dwell time suggests inadequate real-time monitoring and alerting on sensitive data stores. While passwords and payment card data were not exposed, the scale of personal information stolen — names, contact details, membership data, and order history — creates significant risk for phishing, identity theft, and social engineering attacks against affected customers. This incident highlights how even partial data breaches at retail scale can cause enormous downstream harm to millions of individuals.","**Immediate actions:**\n- Conduct a full audit of all access logs for sensitive customer databases to identify any additional unauthorized activity\n- Deploy or tune anomaly detection rules to flag bulk data reads or unusual query volumes from any single session\n- Notify affected customers with specific guidance on recognizing phishing attempts that may exploit the exposed information\n\n**Long-term improvements:**\n- Implement data minimization and retention policies so that only necessary customer data is stored and older records are purged\n- Enforce least-privilege access controls on all systems holding customer PII, limiting which accounts and services can query large datasets\n- Segment customer database infrastructure from general application tiers to limit lateral movement in future intrusions\n\n**Detection measures:**\n- Deploy a SIEM or data activity monitoring (DAM) solution with real-time alerting on high-volume data access events\n- Establish a formal mean-time-to-detect (MTTD) target and regularly test detection capability through tabletop exercises and red-team drills\n- Implement honeypot records within customer databases to trigger immediate alerts if accessed by unauthorized parties",[12,13,14,15,16],"NIST CSF 2.0 DE.CM-01: Monitoring of networks and systems","CIS Control 13: Network Monitoring and Defense (v8)","NIST SP 800-53 AC-6: Least Privilege","GDPR Article 32","NIS2 Article 21(2)(i)",{"GDPR Article 32":18,"NIS2 Article 21(2)(i)":19,"NIST SP 800-53 AC-6: Least Privilege":20,"CIS Control 13: Network Monitoring and Defense (v8)":21,"NIST CSF 2.0 DE.CM-01: Monitoring of networks and systems":22},"Article 32 requires organizations to implement appropriate technical measures — including monitoring and access controls — to ensure security of personal data, all of which were insufficient to prevent or promptly detect this breach.","This point requires adequate access control and asset management policies, the absence of which allowed an attacker to access sensitive customer data systems without triggering timely detection.","Applying least privilege to database access would have restricted which accounts or services could read large volumes of customer PII, limiting the attacker's ability to exfiltrate data at this scale.","This control requires monitoring network traffic and data flows to detect exfiltration events, which would have identified the large-scale theft of customer records before it reached 37.6 million entries.","Continuous monitoring of systems and networks would have flagged the abnormal bulk access to 37 million customer records far earlier than the three-week dwell time observed.","published","2026-11-10T21:20:22.513082+00:00","2026-11-10T21:20:22.479+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fjapanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records\u002F","japanese-furniture-giant-nitori-says-hackers-stole-37-6m-customer-records-e01c8b","Japanese furniture giant Nitori says hackers stole 37.6M customer records",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[51,55,59],{"slug":52,"name":53,"problem":54},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":56,"name":57,"problem":58},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",{"slug":60,"name":61,"problem":62},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool."]