Hackers Exfiltrate 37.6 Million Customer Records from Japanese Retailer Nitori

What happened

Nitori detected unauthorized access on 6 Nov 2026, blocked the intruder, and revealed that the attacker likely had been on the network since mid‑October, exfiltrating 37.62 million records of personal and corporate data.

Why it matters for trust and compliance

• Early detection through robust logging satisfies the ‘Monitoring and Logging’ control objective, a single control that maps to many frameworks such as NIST CSF Detect and ISO 27001 A.12.4.
• Demonstrates the need for continuous evidence collection on log integrity and review frequency.
• Supports audit readiness by linking monitoring controls to multiple compliance frameworks via the Verisq Common Framework.

Who is affected

Recommended actions

1. Validate that all critical systems generate immutable logs and that log retention meets regulatory periods.
2. Map your logging controls to the VCF ‘Monitoring and Logging’ objective and collect evidence for audit purposes.