{ "story_id": "9a03dd0126d54aecb2b744ebb8f8a239", "desk": "bad-news-beat", "revision": 1, "published_at": "2026-11-12T01:48:18.051Z", "content_hash": "b9c1301e6c7e662d1dbaa0199ed2d048ae1cf0d8945d440b5ddd1a121921d048", "hash_basis": "sha256 over `headline\\ndek\\nprose`, plus `\\n` + the canonical citations JSON when any source is placed, plus `\\n#blog` for blogs", "basis": { "headline": "Japan's Nitori says up to 37.62 million customer records may have leaked", "dek": "The intruder was inside for about three weeks before detection. Addresses and emails are exposed. Passwords and card numbers are not, the company says.", "prose": "Nitori Holdings said up to 37.62 million customer records may have leaked.[^1] Nitori is a major Japanese furniture and home accessories retailer.[^2] Unauthorised access to its systems was the cause.[^3]\n\n## Three weeks inside\n\nNitori detected the unauthorised access on 6 November.[^4] The attacker likely had access from the middle of October.[^5] That is about three weeks between entry and discovery.\n\nThe company blocked the access once it was found.[^6]\n\n## What was exposed\n\nThe exposed data includes customers' email and home addresses.[^7] Login passwords and credit card information were not compromised.[^8]\n\n## What customers face\n\nAn email address joined to a home address is enough to write a convincing fake message. Nitori warned customers of possible phishing and scam attempts.[^9] It will contact those affected by mail or email.[^10]\n\nIt has notified the Japanese authorities.[^11]\n\n## A second Japanese leak the same day\n\nThe same report carried another disclosure. Sega reported that around 2.2 million customer email addresses were leaked.[^12] That leak came from a compromised system at a third-party contractor.[^13] No fraudulent use of the Sega data has been confirmed.[^14]", "cited": "[{\"statement\":\"Nitori Holdings stated up to 37.62 million customer records may have leaked.\",\"source\":\"thestar.com.my\",\"instrument\":\"\",\"claim_key\":\"doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:1\",\"url\":\"https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/09/cyberattack-puts-3762-million-nitori-customer-records-at-risk\"},{\"statement\":\"Nitori is a major Japanese furniture and home accessories retailer.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115269:0\",\"url\":\"https://www.bleepingcomputer.com/news/security/japanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records/\"},{\"statement\":\"Unauthorised access caused the possible Nitori customer record leak.\",\"source\":\"thestar.com.my\",\"instrument\":\"\",\"claim_key\":\"doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:2\",\"url\":\"https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/09/cyberattack-puts-3762-million-nitori-customer-records-at-risk\"},{\"statement\":\"Nitori detected unauthorized system access on November 6 2026.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115269:1\",\"url\":\"https://www.bleepingcomputer.com/news/security/japanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records/\"},{\"statement\":\"The attacker likely had system access since mid-October 2026.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115269:3\",\"url\":\"https://www.bleepingcomputer.com/news/security/japanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records/\"},{\"statement\":\"Nitori blocked the unauthorized access after detection.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115269:4\",\"url\":\"https://www.bleepingcomputer.com/news/security/japanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records/\"},{\"statement\":\"Exposed Nitori data includes customer email and home addresses.\",\"source\":\"thestar.com.my\",\"instrument\":\"\",\"claim_key\":\"doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:3\",\"url\":\"https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/09/cyberattack-puts-3762-million-nitori-customer-records-at-risk\"},{\"statement\":\"Nitori login passwords and credit card information were not compromised.\",\"source\":\"thestar.com.my\",\"instrument\":\"\",\"claim_key\":\"doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:4\",\"url\":\"https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/09/cyberattack-puts-3762-million-nitori-customer-records-at-risk\"},{\"statement\":\"Nitori warned customers of possible phishing and scam attempts.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115269:7\",\"url\":\"https://www.bleepingcomputer.com/news/security/japanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records/\"},{\"statement\":\"Nitori will contact affected customers via mail or email.\",\"source\":\"thestar.com.my\",\"instrument\":\"\",\"claim_key\":\"doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:8\",\"url\":\"https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/09/cyberattack-puts-3762-million-nitori-customer-records-at-risk\"},{\"statement\":\"Nitori notified Japanese authorities about the incident.\",\"source\":\"bleepingcomputer.com\",\"instrument\":\"\",\"claim_key\":\"doc:page-html-115269:6\",\"url\":\"https://www.bleepingcomputer.com/news/security/japanese-furniture-giant-nitori-says-hackers-stole-376m-customer-records/\"},{\"statement\":\"Sega reported around 2.2 million customer email addresses were leaked.\",\"source\":\"thestar.com.my\",\"instrument\":\"\",\"claim_key\":\"doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:9\",\"url\":\"https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/09/cyberattack-puts-3762-million-nitori-customer-records-at-risk\"},{\"statement\":\"The Sega leak came from a compromised third party contractor system.\",\"source\":\"thestar.com.my\",\"instrument\":\"\",\"claim_key\":\"doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:10\",\"url\":\"https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/09/cyberattack-puts-3762-million-nitori-customer-records-at-risk\"},{\"statement\":\"No fraudulent use of Sega leaked data was confirmed.\",\"source\":\"thestar.com.my\",\"instrument\":\"\",\"claim_key\":\"doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:12\",\"url\":\"https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/09/cyberattack-puts-3762-million-nitori-customer-records-at-risk\"}]", "kind": "news" }, "receipt_verify": "Ed25519 over the dot-joined string `slice_hash.cursor_from.cursor_to.view.view_version.row_count`; public_key and sig are base64url of the raw 32-byte key / 64-byte signature", "receipt": { "slice_hash": "cb818d0e42f6aa140e13d9fb41ca1158ac6721735e7a7f8e83f27611e0047cb1", "cursor_from": "ingest:raw_newsroomfloor.stories:cb818d0e42f6aa14", "cursor_to": "ingest:raw_newsroomfloor.stories:cb818d0e42f6aa14", "view": "ingest:raw_newsroomfloor.stories", "view_version": "1", "row_count": 1, "hash_basis": "sha256 over the JSON array of {insertId, json} rows as received (normalized wire shape), computed before the BigQuery forward", "credits": 0.01, "price_per_100_rows_written": 1, "sig": "5_RIEJnkRZb9SstGU-h8nt44XJEmnLuislGRTgHsYO1NFaN0AFw03wFF0K20j7MNaeEPvRayvAmf1lNcGqjtAg", "public_key": "bMUigy8O0jOnBxQ4Sc-5lwhIZ8LQVAhxMbR7qESVuUE", "signer_path": "lakehouse/data-extract/v1", "alg": "Ed25519", "signed": true }, "receipt_note": "the ingest door's signed receipt for this revision, verbatim as the door returned it", "generation_chain": "written by a human-directed session at the desk; the revision trail is that record", "cited_facts": [ { "n": 1, "statement": "Nitori Holdings stated up to 37.62 million customer records may have leaked.", "source": "thestar.com.my", "instrument": "", "claim_key": "doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:1", "occurred_at": null, "published_at": null }, { "n": 2, "statement": "Nitori is a major Japanese furniture and home accessories retailer.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115269:0", "occurred_at": null, "published_at": null }, { "n": 3, "statement": "Unauthorised access caused the possible Nitori customer record leak.", "source": "thestar.com.my", "instrument": "", "claim_key": "doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:2", "occurred_at": null, "published_at": null }, { "n": 4, "statement": "Nitori detected unauthorized system access on November 6 2026.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115269:1", "occurred_at": null, "published_at": null }, { "n": 5, "statement": "The attacker likely had system access since mid-October 2026.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115269:3", "occurred_at": null, "published_at": null }, { "n": 6, "statement": "Nitori blocked the unauthorized access after detection.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115269:4", "occurred_at": null, "published_at": null }, { "n": 7, "statement": "Exposed Nitori data includes customer email and home addresses.", "source": "thestar.com.my", "instrument": "", "claim_key": "doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:3", "occurred_at": null, "published_at": null }, { "n": 8, "statement": "Nitori login passwords and credit card information were not compromised.", "source": "thestar.com.my", "instrument": "", "claim_key": "doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:4", "occurred_at": null, "published_at": null }, { "n": 9, "statement": "Nitori warned customers of possible phishing and scam attempts.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115269:7", "occurred_at": null, "published_at": null }, { "n": 10, "statement": "Nitori will contact affected customers via mail or email.", "source": "thestar.com.my", "instrument": "", "claim_key": "doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:8", "occurred_at": null, "published_at": null }, { "n": 11, "statement": "Nitori notified Japanese authorities about the incident.", "source": "bleepingcomputer.com", "instrument": "", "claim_key": "doc:page-html-115269:6", "occurred_at": null, "published_at": null }, { "n": 12, "statement": "Sega reported around 2.2 million customer email addresses were leaked.", "source": "thestar.com.my", "instrument": "", "claim_key": "doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:9", "occurred_at": null, "published_at": null }, { "n": 13, "statement": "The Sega leak came from a compromised third party contractor system.", "source": "thestar.com.my", "instrument": "", "claim_key": "doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:10", "occurred_at": null, "published_at": null }, { "n": 14, "statement": "No fraudulent use of Sega leaked data was confirmed.", "source": "thestar.com.my", "instrument": "", "claim_key": "doc:cyberattack-puts-3762-million-nitori-customer-records-at-ris-419915:12", "occurred_at": null, "published_at": null } ], "note": "A signature proves who filed this and that it has not changed since. It never makes a claim true. The dates on cited_facts (occurred_at, published_at) are the forge's, joined at read time; they are not part of the signed basis above." }